CRE prepares for rising fraud and cybercrime threats

Payments are distinctly susceptible to fraud.

Fraud attacks from payments continue to intensify. In 2025, 76% of organizations reported attempted or actual payments fraud. While nearly a third of companies that fell prey to payments fraud were able to recover more than 75% of funds, 15% regained a tenth or less of what was stolen, and 20% were unable to recover any amount of funds lost to cybertheft.^{Disclosure 1}

Checks remain the method of choice for fraudsters, who used them in 58% of payments fraud events or attempts.^{Disclosure 1} Though organizations increasingly use alternative payment methods, check fraud is still prevalent at many commercial real estate businesses. The United States experienced $33.6 billion in losses from check fraud in 2025, accounting for 87% of all losses globally.^{Disclosure 2} The Federal Reserve attributes the increase to a 32% rise in counterfeit checks, a 21% rise in check washing, and an 18% rise in forgery and physical alteration.^{Disclosure 3} Despite these risks, 72% of organizations have no immediate plans to stop using checks.^{Disclosure 1}

ACH debits and credits account for a combined 48% of payments fraud. Criminals deceptively obtain business checking account and bank routing numbers to make unauthorized ACH payments (30%) or ACH credits (18%).^{Disclosure 1} ACH debits are involved in 34% of business email compromise (BEC) fraud events, with only wire transfers taking a larger share of completed or attempted instances of BEC fraud.^{Disclosure 1}

Wire transfers are targeted in 25% of all payments fraud events. Wire fraud represents 49% of incidents in which criminals use BEC to transfer funds to a fake or unauthorized bank account.^{Disclosure 1} With access to an email account, an imposter then poses as a key employee or third-party partner and communicates false payment instructions.

Commercial credit cards account for just over one-fifth of the total payments fraud events and attempts sustained by organizations.^{Disclosure 1} Sometimes employees misuse their corporate credit cards for personal transactions, but business credit cards are also vulnerable to use by criminals outside an organization, who may use lost and stolen cards or account information to make purchases or withdraw cash.

Most common fraud tactics

Business email compromise represents the greatest vulnerability for companies, with 74% experiencing some form in 2025.^{Disclosure 1} It usually happens through social engineering attacks in which criminals successfully guess or steal email credentials. Three-quarters of all impersonation fraud is due to BEC attacks.^{Disclosure 1} Instead of hacking into email accounts and searching for sensitive information, impersonation attacks hinge on using hijacked email accounts to impersonate a company executive, vendor, or government agency. Posing as a trusted individual or entity, fraudsters then trick employees into making fraudulent payments, sharing sensitive information, or opening email attachments that deploy malware.^{Disclosure 1}

Imposters can also compromise a business’s email by creating an email address or website that appears to be legitimate. Customers are deceived into sharing passwords, revealing bank information, or making payments to a scammer. Fraudsters who target your customers in this way create reputational risk and damage the relationship of trust your business has worked so hard to build.

Most fraud comes from external sources. However, our CRE clients tell us that third-party partners, like title companies, law firms, brokers, and financial institutions, also create risk exposure for organizations when information they retain on your business or its customers is compromised.

Recognize rising cyber risks.

Shore up your defenses.

Process improvements that can strengthen fraud prevention

Technology use best practices that can combat fraud

Craft your response plan now.