Key points
- BEC attacks caused approximately $55 billion in worldwide losses.
- Thirty-six percent of US organisations faced a BEC attack in the past year.
- AI-powered social engineering is viewed as a major emerging risk by IT professionals.
Business email compromise (BEC) attacks allow threat actors to manipulate organisational communications for financial gain, resulting in significant global losses. According to Huntress research, these scams generated $55 billion in damages worldwide, with the figure expected to increase as techniques evolve.
The primary objective of these campaigns is financial theft through wire fraud or credential harvesting. Attackers impersonate trusted entities to convince employees to transfer funds or disclose sensitive data. This method relies on deceiving staff rather than exploiting technical software flaws directly.
The mechanics of deception
Threat actors begin with reconnaissance to map organisational structures, identifying key roles and relationships. They then use adversary-in-the-middle techniques to intercept login credentials and session tokens. Once access is secured, they take over email accounts to send fraudulent requests that mimic legitimate internal communications.
Who is affected
Huntress surveyed more than 500 US IT professionals, finding that 36% of organisations experienced a BEC attack within the last 12 months. This makes it the third-most-reported cybercrime, trailing only malware infections and phishing. Financial gain was the suspected motivation in 27% of cases.
What happens next
The integration of generative AI complicates defence efforts by producing convincing content that matches the tone of trusted colleagues. Thirty-eight percent of IT professionals cite AI-powered social engineering as their biggest unanticipated risk. Forty-two percent believe AI-driven attacks will significantly change the cybercrime landscape over the next five years.
Why this attack works
BEC exploits the inherent trust placed in internal communication channels. Teams usually rely on email for urgent financial instructions, creating a vector for fraud. The weakness lies in the difficulty of verifying sender identity through standard interfaces. Attackers serve the initial access and lateral movement stages by hijacking legitimate accounts. This bypasses perimeter defences that focus on external threats. Check whether your protocols require out-of-band verification for payment changes.
What to do and how to stay safe: Huntress
- Verify unexpected payment requests through a secondary communication channel, such as a phone call.
- Train staff to scrutinise sender addresses and look for subtle discrepancies in tone or urgency.
- Implement strict procedures for handling sensitive data and financial transfers.
- Monitor for unusual account activity that may indicate an adversary-in-the-middle scenario.
Step-by-step guide: Security Awareness Training: How Human Behaviour Shapes Defence
General security guidance from the Payload Report newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How much have BEC attacks cost businesses globally?
BEC attacks have resulted in approximately $55 billion in losses worldwide.
What percentage of US organisations faced a BEC attack recently?
Thirty-six percent of organisations experienced a BEC attack in the past 12 months.
How does AI impact BEC attacks?
Generative AI helps attackers create legitimate-looking content that mimics trusted sources, making detection harder.
