Not only BEC, the recovery rate for ridiculously named authorized push payment fraud fraud (i.e. craigslist car scams) is also very low.

Reg E at least protects consumers from some banking malware, but still does not provide protections for phishing victims (despite new non-binding CFPB guidance)