ForUS small businesses, from solo owners to 500 people, that take paymentsUS (California noted)Canada (short section)Global and UK figures labeled
Fraud in 2026 for US small businesses, from solo owners to 500 people: what it costs, how it happens, and why payments still mostly work.
Losses reported to the FBI rose 26% to $20.9 billion in 2025 (all complaint types; cyber-enabled fraud was $17.7 billion of it). Payment systems (“rails”) mostly work; the big losses come when staff are tricked into sending money, as in business email compromise ($3.05 billion in 2025). Checks are the most-attacked payment type (58% of US organizations, AFP survey, 2025); online merchants worldwide put fraud at 3.5% of accepted orders in 2026.
The newest evidence is survey and FBI data from 2025–26. The card loss rates further down are 2024 data published in January 2026, the newest available; the 2025 rates are due in January 2027.
Each figure counts something different
The merchant survey’s first-party-misuse share of fraudulent disputes was 17% in 2026, down from 20% (MRC and Visa Acceptance 2026 report, p. 8; merchant-reported, global).
76% hit by payments fraud in 2025
3.5% fraud rate by order (2026)
13% of Canadians had payment fraud
75% saw debit fraud attempts (Q4 2025 survey)
60% say fraud losses increased (2026)
$5.13 total cost per $1 of fraud loss (2026)
ACH fraud volume +38%, value +52% (2025)
Fraud pressure +33% year over year (Jan–Apr 2026; vendor claim, global)
UK payment fraud £1.28B, up 4%
One cent per $100 is one basis point (bp), or 0.01%. The rest of the world: 5.1¢ in 2024. Nilson’s volume includes ATM cash. Nilson’s 2025 figure is not out yet; it usually releases a full year the following January, so 2024 is the newest published year and 2025 is due in January 2027. The US figure is our division of Nilson’s published US shares of losses and volume, not a number Nilson publishes. Sources: Nilson releases of 7 Jan 2026 and 6 Jan 2025, read 23 Oct 2026.
There is no current official fraud rate for ACH or checks. The Fed’s last cross-rail comparison covers 2015–16, so we left it out; its 2025 triennial payments study (1 Jul 2026) reports 2024 volumes but no fraud findings yet. The nearest 2025 evidence is a survey, not a loss rate: AFP’s 2026 survey of 465 treasury staff (organizations of varying sizes, self-reported) found 58% of organizations saw check fraud and 30% saw ACH debit fraud, attempted or actual. A Fed survey of 403 banks and credit unions (Q4 2025; primary, institutions not businesses) found debit cards the most-hit rail: 75% saw attempts and 56% had losses. Neither gives a rate per dollar. Sources: Fed debit report, 19 Dec 2025; Nilson; Fed, 1 Jul 2026; Fed Financial Services, 14 May 2026; AFP 2026 survey highlights (Truist copy).
Where it fails. The rates above count unauthorized payments: stolen cards, forged checks. They miss payments a firm sends itself after being fooled. Those are rising, and the next section counts them.
The FBI’s Internet Crime Complaint Center (IC3) and the FTC’s Consumer Sentinel count what victims report. Both rose again in 2025.
FBI IC3 (US, complaints reported by victims): $20.877 billion lost in 2025, up 26%, from 1,008,597 complaints. Business email compromise: 24,768 complaints and $3,046,598,558 in 2025, against $2,770,151,146 in 2024. Source: FBI Internet Crime Report 2025, copy supplied 25 Oct 2026 (primary; PDF pages 4, 6, 7–9, 25–26; public link ic3.gov). Cross-check only: a law-firm summary gives the same 2025 totals (McDonald Hopkins, 7 Apr 2026).
$15.9 billion reported lost, up 27%
| Type (IC3) | Complaints 2024 | Complaints 2025 | Lost 2024 | Lost 2025 | Average 2025 |
|---|---|---|---|---|---|
| Business email compromise | 21,442 | 24,768 | $2,770M | $3,047M | $123,005 |
| Credit card or check fraud | 12,876 | 18,774 | $200M | $283M | $15,056 |
| Non-payment or non-delivery | 49,572 | 56,478 | $785M | $503M | $8,913 |
| Tech or customer support scams | 36,002 | 47,794 | $1,465M | $2,135M | $44,664 |
| Phishing or spoofing | 193,407 | 191,561 | $70M | $216M | $1,127 |
Shaded row: business email compromise has the largest dollar loss in this table ($3,047M in 2025, an average of $123,005 a complaint), so it is the row to read first.
First in losses: $3.67 billion
58% frozen by the FBI Recovery Asset Team
22,364 complaints, $893 million (2025; FBI report)
The Association for Financial Professionals (AFP) surveys corporate treasury staff each year. Its 2026 survey covers 2025, and checks still top the list.
AFP 2026 Payments Fraud and Control Survey: 465 treasury staff, fielded Jan 2026. Mostly larger firms, not a small-business sample. 76% saw some payments fraud; 74% saw business email compromise. Sources: AFP release, 14 Apr 2026; key highlights.
A real-looking request to pay a new account
63% of banks saw check fraud attempts (Q4 2025)
Someone signs in as you
7% of firms hit by fraud saw deepfake attempts (2025)
Bank payments top 2025 losses
A real buyer disputes a real sale
Stolen card numbers used online
The Fed’s debit card report shows who paid for fraud in 2023. Merchants paid more than banks and cardholders.
The Fed’s 2023 data are the latest available. The three shares add to 17.54 bp in the Fed’s table; the gap is rounding. Source: Fed, 2023 Interchange Fee Revenue … report, 19 Dec 2025, read 23 Oct 2026.
Fees count too. A lost dispute costs the sale, the goods and a dispute fee. Merchants put the average cost to resolve a first-party dispute above $80 (MRC and Visa Acceptance 2026 report, p. 8; global, merchant-reported). Holds, reserves and payouts in The Small Print →
Nacha writes the rules for ACH payments. In 2026 it made every party, down to a one-person business that sends payroll, watch for fraud.
Fast and final
30% hit; blocks help
A relative bright spot
No official source breaks fraud down for firms under 50 people. These profiles combine the data above with the calculator’s example firms.
72% hit by fraud, scams or ransomware (2025)
Example firms are illustrations, not data. Card losses use 8.75 bp, merchants’ share of debit fraud in 2023. Solo $131, ~20 staff $2,625, ~100 staff $13,125 a year in card losses. The chances of a loss, the card sales and the loss sizes on the three smaller cards are our own assumptions too, not findings.
100 to 500 people. We stop at about 100: we found no source for card sales, fraud odds or loss sizes above that, so the calculator has no preset beyond it. For a firm of 100 to 500 people, start from the ~100 preset and replace the card sales, the chances and the loss sizes with your own; the same controls (call-back rule, positive pay, two-person approval) apply to more accounts and payees. The FBI averages are per complaint, from all complainants, not by firm size.
The red flags come from the FBI, FinCEN and the US Postal Inspection Service (USPIS). Tick the controls you already have; nothing is stored.
0 of 12 in place.
Start from an example firm, then put in your own numbers. The chance of a loss is your estimate: no official source gives a small firm’s odds. The $25, $45 and $80 control prices come from two credit unions’ schedules; the When Fraud Hits post lists eight banks at $0–$75. The samples differ and are not combined.
Start from an example firm
Card fraud and dispute loss rate you bear
Positive pay fee a month
How much a control cuts the risk (your assumption)
Assumptions. Expected loss = chance × loss if it happens; card loss = sales × rate. Call-back and multi-factor sign-in cut email and impersonation risk; positive pay cuts check risk. Card losses are left to your processor’s tools. Positive pay fees from two credit unions’ 2025–26 schedules. Expected values understate a single large loss; the last line shows that risk. Where the inputs come from. Sourced: the 8.75 bp card rate (Fed, merchants’ share of 2023 debit fraud), 17.6 bp (Fed, all parties), $123,005 and $15,056 (FBI 2025 averages per complaint), and the $25, $45 and $80 positive pay fees (two credit unions). Our own assumptions, not findings: each example firm’s card sales, chances of a loss and loss sizes, the call-backs a month, 10 minutes and $40 an hour, the $0 multi-factor cost, and the 25%, 50% and 75% risk cuts. The card rate is a debit rate applied to all card sales, which is also our simplification.
At the ~5-staff example: expected loss $1,906 a year ($656 cards, $800 email fraud, $450 checks). Call-backs cost $240 a year and avoid $400, paying back in 7.2 months. Positive pay at $45 a month costs $540 and avoids $225. It pays only once expected check losses top $1,080 a year. One $40,000 loss equals 167 years of call-backs.
The Canadian Anti-Fraud Centre (CAFC) collects reports nationwide. It says only 5% to 10% of frauds get reported.
Over C$704 million, 112,000 reports
C$67.9 million, second by loss
Who pays when fraud hits, what proof to keep and what fraud tools cost are in the companion post, Part 1b. In most cases the business carries the loss; the exceptions and the time limits are there.
Open, not answered. Other parts of the Trust series pick some of these up.
The Trust series. This is Part 1. Next: The Compliance Stack (Part 2); Built to Be Trusted: High-Trust Architecture for a Small Firm (Part 3); What AI Can Learn From Payments (Part 4); Safe, Private and Personal AI: a New Small-Business Type (Part 5); Robots and Your Business (Part 6).
Where a rule above comes from a provider's terms, The Small Print quotes and rates it.
We make the hidden visible, the complex simple and the unheard heard.
The research, views and analysis are our own.
Spotted an error, or represent a company named here? Write to hello@foregaze.ai . We fix errors, date each change and publish company responses.
We're not lawyers, accountants or financial advisers. This covers published prices and terms as read on the dates shown under Sources.
Read on the dates shown under Sources. Prices and terms change and vary by plan, region and contract, and custom-priced accounts can differ. Check the provider's own page before you sign or switch.
Complaints and forum reports are what businesses say, unverified unless marked. Nothing here says a company broke the law.
Written by ForeGaze Research. Claude (made by Anthropic) helped with drafting, layout and website design. Every number is checked against the sources listed and manually checked. ForeGaze is responsible for the content.
Company and product names are trademarks of their owners. Short quotes are used for commentary.
Every ForeGaze post sits in one or more series. See them all on the Post Map.
Most losses here start with one changed bank detail or one stolen check. Go back to the checklist, tick what you already have, and start with the cheapest gap: a call-back rule.
Open the protect-your-payments checklistRules and fees change; check with your bank and processor before you act. Provider names are trademarks of their owners. See Disclaimers above.