Fraud risk changes as technology and business practices change. As a result, fraudsters keep finding new ways to exploit weak spots. For business owners, the goal is to stay alert without overcomplicating controls.
The Association of Certified Fraud Examiners (ACFE) helps by publishing Occupational Fraud 2026: A Report to the Nations. The report summarizes how fraud happens, who commits it, and which controls reduce losses.
Scope of the report
Every two years, the ACFE publishes a global study on occupational fraud. This matters because it gives owners real benchmarks based on real cases.
The 2026 report covers 2,400+ cases across 143 countries. Like prior reports, it estimates that the typical organization loses about 5% of annual revenue to fraud.
However, that 5% figure is likely conservative. Many schemes go undetected. In addition, some losses are indirect, such as reputational harm and lost productivity.
Key findings business owners should know
Median losses
Globally, the median fraud loss in the 2026 study was about $104,000 (down from $145,000 in 2024). For organizations with fewer than 100 employees, the median loss was $126,000.
Even when dollar losses look similar across company sizes, the impact can be worse for smaller businesses. For example, a six-figure loss can erase a year of profit.
Industries most affected
Some industries see more fraud cases than others. In the 2026 study, the highest case counts were reported in:
- Banking and financial services
- Government and public administration
- Manufacturing
- Health care
- Retail
Meanwhile, industries with the highest median losses per incident included mining, wholesale trade, real estate, energy, and transportation/warehousing.
Who commits fraud
Frauds committed by owners and executives caused the largest losses (median of $475,000). Losses were lower when fraud was committed by managers ($125,000) or employees ($50,000).
Over time, the profile has shifted. Specifically, managers and executives now account for a larger share of cases than they did decades ago.
How long fraud lasts
The median duration of fraud schemes was 12 months. Not surprisingly, longer schemes usually cause larger losses.
For example:
- Frauds caught within 6 months: median loss $40,000
- Frauds lasting 5+ years: median loss $1.12 million
At the same time, most cases are caught sooner. About one-third lasted less than six months, while only 5% lasted more than five years.
Three common types of occupational fraud
The ACFE groups occupational fraud into three broad categories:
- Asset misappropriation (90% of cases)
This includes theft of cash, inventory, or other resources. - Corruption (45% of cases)
This includes kickbacks, bribery, and conflicts of interest. - Financial statement fraud (6% of cases)
This includes intentional misstatements or omissions in financial reporting.
Although financial statement fraud is less common, it tends to be the most expensive. In the report, the median loss was about $1 million.
Controls that reduce losses
Understanding fraud types helps. However, controls are what reduce losses.
In the 2026 report, the five measures associated with the largest reduction in median fraud loss were:
- Management review
- Proactive data monitoring and analysis
- Formal code of conduct
- Surprise audits
- Job rotation and mandatory vacations
On the other hand, the report found that three weaknesses show up repeatedly:
- Lack of internal controls
- Override of existing controls
- Lack of management review
These weaknesses are especially common in smaller organizations. Therefore, even basic improvements can help.
How fraud is most often discovered
Controls reduce risk, but they do not guarantee prevention. So, detection still matters.
The top detection methods included:
- Tips (43%)
- Internal and external audit (17% combined)
- Management review (13%)
Employees provided most tips. In addition, web-based and email reporting channels are now more common than phone hotlines.
The ACFE also recommends pairing fraud training with a formal reporting mechanism. In the report, organizations with both had lower median losses and shorter fraud duration than those without them.
Bottom line
Fraud is a risk for every organization. Still, many effective steps are practical and affordable. Start with management review, basic data monitoring, and a clear reporting process. Then reinforce those steps with training.