What Should a Small Business Fix First? The FBI's 2025 Numbers Ranked by Cost, Which Ones Reach Businesses, and Five Fixes in the Order We Would Do Them
If you run a small business and can fix only one thing this month, make it the rule that nobody changes a bank account or pays a new one on the strength of an email alone. After that, turn on multi-factor sign-in for email, keep an offline copy of your data that you have tested restoring, patch whatever faces the internet, and decide now who calls the bank when something goes wrong. That order comes from the FBI's 2025 Internet Crime Report, which counted 1,008,597 complaints and $20.877 billion in reported losses, up 26 percent from 2024. One warning first: the FBI's report does not split its figures by the size of the victim, so these numbers describe everyone who filed a complaint, and we use them to rank risks and not to claim what small businesses specifically lost.
What cost the most in 2025?
These are the FBI's reported losses, from complaints filed with its Internet Crime Complaint Center.
- Investment fraud: $8,648,617,756.
- Business email compromise: $3,046,598,558 on 24,768 complaints.
- Tech support scams: $2,134,675,818 on 47,794 complaints.
- Personal data breach: $1,314,923,988 on 67,456 complaints.
- Romance and confidence fraud: $929,287,469, and government impersonation: $797,943,193.
- Account takeover: about $359.7 million on about 4,700 complaints.
- Phishing and spoofing: $215,843,126 on 191,561 complaints. That is about three times the $70,013,036 reported in 2024, and more than eleven times the $18,728,550 in 2023, even though the number of complaints was flat.
- Extortion: $122,499,133 on 89,129 complaints.
- Ransomware: $32,320,105 on 3,611 complaints, against $12,473,156 in 2024. The FBI says that figure leaves out lost business, time, wages, files, equipment and any outside clean-up costs, and that some organizations report no loss at all, so it is artificially low.
Which of these reach a business?
Business email compromise is defined as a scam against businesses and the people who work with suppliers or wire money regularly, so it belongs on the list by definition. Account takeover, tech support scams, phishing and ransomware all reach businesses too. The report does not say how many victims of investment, romance or government-impersonation fraud were businesses, so we leave those out of the ranking below. The FBI also notes that its fund-freezing team saw a rise in tech support and account takeover cases in 2025, and that business email compromise used to be most of its work.
The ransomware figures are worth a second look for what they say about size. The FBI reports that the most frequent variants, led by Akira and Qilin, most affected critical manufacturing, healthcare and public health, and government facilities, and that 63 new variants were identified in 2025. It does not break ransomware down by business size.
Five fixes, in the order we would do them
The first, fourth and fifth are the FBI's own guidance or built from it. The order and the rest are our suggestions.
- No bank change on an email alone. Confirm any new payee or changed bank detail by calling a number you already had, and require a second person to approve it. This one rule addresses the second-largest loss category. We wrote the detail in "What Is Business Email Compromise?"
- Multi-factor sign-in on email and remote access. The FBI's ransomware advice says to enable it for all services where possible, particularly webmail, virtual private networks and accounts that reach critical systems. For the accounts that move money, prefer a hardware key or passkey, since a one-time code can be relayed by a fake page. We covered that in "What Is Account Takeover?"
- Offline copies you have tested. The FBI recommends off-site or offline backups that are encrypted and immutable, cover the whole organization's data and are restored in tests. A backup you have never restored is a hope.
- Patch what faces the internet. The FBI calls timely patching one of the most efficient and cost-effective steps, and says to prioritize known exploited vulnerabilities in internet-facing systems. Start with firewalls, remote-access gateways and mail.
- Know who calls the bank. If money has moved, the FBI's advice is to contact your financial institution immediately, ask for a recall of the funds and any indemnification documents, and file a complaint at ic3.gov regardless of the amount. In 2025 its recovery team froze $679,013,183 of $1,163,919,846 in attempted theft, a 58 percent success rate. Write the bank's fraud number down today.
Two more items from the FBI's list cost little and are worth doing alongside: remove default passwords from anything you install, and limit administrator accounts to the people who need them.
What this does not tell you
It does not tell you your own odds. The numbers come from complaints people chose to file, and many victims never report. They do not separate a five-person shop from a large company. The percentage comparisons for phishing losses are our arithmetic from the report's table. And the FBI's loss figures count money, not downtime.
Indicators
None. This is a risk-ranking explainer, so we added nothing to the feed.
Limits
All figures are from the FBI's 2025 Internet Crime Report. We did not verify them independently. The five-fix order is our judgment, informed by those figures and by the FBI's guidance where noted. None of it guarantees safety.
Five percent of this is wrong somewhere. It always is. The FBI's next report will move every number here.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.