Payment fraud by industry is a lopsided picture: a wholesaler loses a median $256,000 per fraud case while a retailer loses $59,000, and federal investigators have ranked construction and manufacturing as the most-targeted sectors for business email compromise. The totals behind that picture keep growing. The FBI’s Internet Crime Complaint Center logged $20.877 billion in reported losses in 2025, up 26 percent in a single year1, and the ACFE’s 2026 global study measured $3.4 billion in occupational fraud losses across 2,402 cases2. What no single report shows is the combined picture, because the FBI counts crime types, the ACFE counts industries, and FinCEN ranked BEC targets in a separate analysis. This guide assembles that league table in one place: median loss by industry, the dominant scheme in each sector, which sectors the federal data says attackers hit first, and the one distinction the rankings hide, the difference between industries robbed through the payments they send and industries robbed at the card reader. One honest note up front: these are medians and reported figures, not your odds. What the table is for is matching the control you buy to the fraud your sector actually suffers.
The league table: median fraud loss by industry
The most direct answer to which industries lose the most comes from the ACFE’s Occupational Fraud 2026 report, which measured 2,402 cases across 143 countries and recorded a median loss of $104,000 and an average of $1,457,000 per case2, with organizations estimated to lose about five percent of revenue to fraud. The medians by industry are where the table gets interesting, because the spread is enormous and it does not track company size or glamour. Mining tops the table at $300,000. Wholesale trade, an industry nobody markets fraud controls to, is second at $256,000. Education, full of large institutions, sits at the bottom at $30,000.
Case counts tell a second story. Government and public administration filed 217 cases, the second-highest count of any industry, and manufacturing filed 193. The FBI’s complaint data adds the crime-type view for 2025: real estate fraud alone drew 12,368 complaints and $275.1 million in reported losses1. Read the columns together and the league table stops being trivia: the sectors that lose the most per case are the ones that move large, irregular business payments, and the dominant scheme in almost every one of them is a payment the victim organization authorized.
| Industry | Median loss per case | Cases in study | Where the loss concentrates |
|---|---|---|---|
| Mining | $300,000 | Small sample | Large payments, remote operations, thin oversight |
| Wholesale trade | $256,000 | 18 | Supplier payments; vendor impersonation |
| Real estate | $250,000 | 38 | Wire-heavy closings and payoffs |
| Transportation and warehousing | $200,000 | 77 | Carrier and freight payment diversion |
| Manufacturing | $170,000 | 193 | Supplier invoice impersonation; FinCEN’s top BEC sector |
| Construction | $120,000 | 93 | Billing schemes in 35% of cases; draw and sub payments |
| Government and public administration | $100,000 | 217 | Vendor BEC against public funds |
| Health care | $100,000 | 140 | AP-side vendor fraud, separate from billing fraud |
| Religious, charitable, and social services | $76,000 | 82 | Weak controls; one person touching every payment |
| Retail | $59,000 | Among the lowest | Occupational only; the big retail losses are card-side |
What FinCEN found when it ranked BEC targets
The Treasury’s Financial Crimes Enforcement Network is the only federal agency that has ranked industries by how often BEC actors actually hit them, using the suspicious activity reports banks must file. Its finding was blunt: manufacturing and construction were the number one target, accounting for 20 percent of analyzed BEC transactions in 2017 and 25 percent in 20183, with attempted thefts climbing from an average of $110 million per month in 2016 to $301 million per month in 2018. FinCEN attributed the exposure to frequent wire use and publicly available client information, and it called out construction and renovation projects at institutions as particularly attractive to attackers.
Two details in that analysis matter more than the ranking. First, the method shifted: impersonating an outside vendor or client overtook impersonating the CEO, with executive impersonation falling from 33 percent of reports to 12 percent while vendor and client impersonation rose to 20 percent. The con moved from the corner office to the vendor file. Second, real estate had the highest average fraudulent transaction of any sector at $179,001 per attempt. That analysis is the most recent federal sector ranking, and the totals have only grown since: the FBI reported $3.046 billion in BEC losses in 2025, with 86 percent of the money moving by wire or ACH1. The public sector shows what a single hit looks like: in April 2025 an Oregon city office wired more than $6 million to a fraudster posing as a vendor, and the Justice Department had to file a forfeiture action to claw back $6.7 million5.
FinCEN’s institutional finding deserves more attention than it gets. The analysis specifically flagged large construction and renovation projects at institutions as attractive to BEC actors, and the recent public loss cases fit that template exactly: school districts and city governments losing seven figures on payments tied to building programs, where the project, the contractor, and the payment schedule were all public record before the first fraudulent email was sent. If your organization funds construction, the sector ranking applies to you twice: once as the payer of a top-targeted industry, and once as an institution whose projects are advertised. The verification burden lands on whoever releases the payment, not on whoever designed the building.
The three traits that make a sector a target
Lay the ACFE medians over the FinCEN ranking and the AFP’s survey data, and the heavy-loss sectors stop looking random. They share three traits. First, money leaves in large, irregular amounts on rails built for speed: the 2026 AFP survey found 76 percent of organizations experienced attempted or actual payments fraud in 2025, with checks targeted at 58 percent of them, ACH debits at 30 percent, and wires at 25 percent4. A wholesaler or a general contractor pays six and seven figures to counterparties whose banking details change legitimately often enough that a fraudulent change does not stand out.
Second, the payment chain is public and fragmented. A school district’s construction program is announced in board minutes. A GC’s subcontractors are on the permit filings. A freight broker books carriers it met yesterday. The attacker does not need to breach anyone to know exactly who owes whom and when; the sector publishes its own target list. Third, nobody at the paying desk owns fraud. In my conversations building RankShield Financial, the pattern repeats: the person updating a vendor record and the person releasing the payment are the same overworked human, and 74 percent of organizations saw BEC attempts against exactly that seam. Sectors with all three traits cluster at the top of the table. That is not a coincidence; it is a mechanism.
One more reading note, because it changes what you do with these numbers. The ACFE average loss of $1,457,000 is fourteen times the $104,000 median, which means the average is being dragged up by a small number of catastrophic cases. Plan against the median, insure against the average. And notice who finds the fraud: the ACFE data shows 43 percent of cases are caught by tips, not by controls, and the median scheme runs a full 12 months before detection. A year of undetected payments is the real cost of having no verification step at the point of release; the tip that eventually surfaces the fraud arrives long after the money settled.
The industries whose fraud is card-side, not payment-side
One correction the league table needs: some famously high-fraud industries barely appear in it, and the reason is instructive. Retail’s occupational median is just $59,000, yet convenience stores and gas stations are among the most defrauded businesses in America. The difference is fraud class. The FBI estimates that card skimming alone costs financial institutions and consumers more than $1 billion annually6, and the IC3 logged $282.7 million in credit card and check fraud complaints in 20251. Those losses hit at the pump and the register, where the store is the merchant, not the payer.
That distinction is the practical takeaway of this whole table. Card-side fraud is fought with inspections, EMV and tap acceptance, law enforcement sweeps, and a defensible evidence trail when a device or a fraud pattern is found. Payment-side fraud, the kind that dominates every sector above, is fought by verifying the payee and the approval before an authorized payment is released. Buying the wrong class of control is how a company ends up well defended against the fraud it does not have. A wholesaler with pristine card security still wires $256,000 to an impostor; a fuel and convenience chain with perfect payee verification still bleeds at a skimmed pump.
The control that fits the loss pattern
Look at what actually dominates the top of the table: billing schemes in 35 percent of construction cases, supplier impersonation in manufacturing, carrier payment diversion in trucking and logistics, vendor BEC against districts and cities. Every one of these is an authorized payment to the wrong payee. No credential is stolen and no account is hacked; a real approver releases a real payment based on a false identity, a false authority, or a false account. Regulation has caught up to that reading: Nacha’s fraud-monitoring rules, whose second phase took effect in June 20267, now require every business that originates ACH credits to screen for payments initiated under false pretenses.
The control that fits this pattern is pre-settlement payment verification: checking who is paying, who is being paid, how much, and why against records you already trust, and requiring proof that an authorized person approved this specific payee and amount before release. This is where RankShield Financial sits. It is a verification and attestation layer in the authorization path, not a wallet or a processor, and it never takes custody of funds. It holds a changed or unverified payee before the money moves and seals a signed, tamper-evident record of who approved what, a verdict that an examiner, an insurer, or a partner can independently check rather than take on faith. That shared signal compounds as members join, rather than claiming a scale we have not yet reached, and the signing is quantum-safe by construction, not quantum-proof. If your industry sits in the top half of this table, the honest question is not whether you have fraud prevention, but whether any of it fires before settlement. You can see how it works.
What to do with your industry’s number
Use the median, not the average, and use it as a budget argument. If you run finance in a sector with a six-figure median loss, that number is what one successful vendor swap or diverted draw costs a business like yours, and it is the cheapest justification you will ever get for putting one control before the wire leaves instead of after. Pull your last twelve months of payments, count how many went to a payee whose banking details changed inside that window, and ask who verified each change and how. In most organizations the honest answer is an email thread. The league table says your sector is already priced into the attackers’ planning. The only question left is whether a changed payee at your company gets verified before the money moves, or explained after it is gone.
