Key points
- Global losses from business email compromise reached approximately $55 billion.
- Thirty-six per cent of US firms reported a BEC attack in the past year.
- Generative AI helps attackers mimic tone and style to bypass human detection.
The short version
- Business email compromise involves impersonating trusted sources to steal funds or data.
- Attackers often use adversary-in-the-middle tactics to capture login credentials.
- Financial gain is the primary motivation, cited by 27 per cent of surveyed professionals.
The details
Business email compromise remains a severe threat to organisations of all sizes, with global losses reaching an estimated $55 billion. According to Huntress research, this figure is expected to rise as techniques become more sophisticated. The attacks rely on impersonating trusted individuals within an organisation to trick employees into transferring money or revealing sensitive information. This method has become the third-most-reported cybercrime, trailing only malware infections and standard phishing attempts in recent surveys.
The financial impact stems from direct fraud and credential theft. Threat actors manipulate email accounts to commit wire fraud or steal login details. A survey of more than 500 US IT professionals revealed that 36 per cent of organisations experienced a BEC attack in the previous 12 months. The primary suspected motivation for these campaigns is financial gain, which aligns with the engineered purpose of the scams.
The context
Generative AI has significantly altered the landscape of these attacks. Threat actors use AI tools to create content that mimics the tone and writing style of trusted colleagues. This makes it difficult for recipients to distinguish between legitimate communications and scams. Huntress reported that 38 per cent of IT professionals consider AI-powered social engineering the biggest unanticipated risk to their organisations. Furthermore, 42 per cent believe AI-driven attacks will be the most significant change in cybercrime over the next five years.
The attack process typically follows a structured path. It begins with reconnaissance, where attackers gather information about names, roles, and relationships. They may use adversary-in-the-middle attacks to place themselves between the user and a service, allowing them to monitor activity and steal credentials. Once they have this data, they compromise an email account through phishing or social engineering.
Defender's checklist
Traditional security tools and spam filters often fail to detect these attacks because the emails appear legitimate. The deception relies on social engineering rather than malicious code. Attackers impersonate executives, such as CEOs or CFOs, or trusted vendors using spoofed or compromised accounts. Recipients are tricked into acting quickly without verifying the request. Close inspection of email addresses and contact details is essential, as these are often the only indicators of fraud.
If your data is involved
If you suspect a breach, verify all recent financial transactions and login activity immediately. Check whether any unusual emails were sent from your account to colleagues or vendors. Look for signs of account takeover, such as changed security settings or unfamiliar devices. Be wary of follow-up messages asking for urgent payment or sensitive data, as attackers often escalate pressure after an initial compromise. Report any suspicious activity to your security team without delay.
Background: Phishing
Phishing is a broad, automated attack sent to thousands of recipients using generic templates. Spear phishing targets specific individuals or organisations using researched personal details. The core difference lies in the level of personalisation. You defend against phishing with technical filters and against spear phishing with verification protocols and human awareness.
Read the full guide: Phishing vs Spear Phishing: Targeting Mechanics and Defence
What to do and how to stay safe: Huntress
- Verify unexpected payment requests through a secondary channel, such as a phone call or in-person conversation, before processing them.
- Monitor email accounts for unauthorised access, including changes to forwarding rules or sent items that you did not create.
- Train staff to recognise signs of AI-generated impersonation, such as subtle errors in tone or context that do not match the sender's usual style.
- Ensure multi-factor authentication is enabled on all email and financial accounts to reduce the risk of credential theft.
Step-by-step guide: Security Awareness Training Mistakes That Leave Gaps Open
General security guidance from the Cipher Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How much do BEC attacks cost globally?
Business email compromise attacks result in approximately $55 billion in losses worldwide.
How common are BEC attacks among US organisations?
Thirty-six per cent of US organisations experienced a BEC attack in the past 12 months.
What role does AI play in these attacks?
AI helps attackers mimic the tone and writing style of trusted sources, making scams harder to detect.
