Huntress research: BEC attacks cost businesses $55 billion globally
New data shows business email compromise is the third-most-reported cybercrime, driven by AI tools that mimic trusted contacts.
Key points
- Global losses from business email compromise reach $55 billion.
- Thirty-six percent of US organizations faced a BEC attack in the last year.
- Generative AI makes these impersonation scams harder to detect.
Business email compromise attacks caused approximately $55 billion in losses worldwide, according to new research published by Huntress. The security firm’s findings highlight the growing scale of fraud that relies on impersonating trusted sources to steal credentials or redirect payments.
A survey of more than 500 US IT professionals conducted by Huntress found that 36% of organizations experienced a BEC attack in the past 12 months. This makes business email compromise the third-most-reported type of cybercrime, trailing only malware infections and general phishing campaigns.
The Mechanics of Impersonation
Threat actors execute these attacks by manipulating email accounts to commit wire fraud or steal login information. Attackers often use generative AI tools to craft messages that mimic the tone and writing style of legitimate contacts. This technological assistance makes it difficult for recipients to distinguish between real communications and sophisticated scams.
Huntress’s Cybercrime Report indicates that 38% of IT professionals view AI-powered social engineering as their biggest unanticipated risk. Furthermore, 42% believe AI-driven attacks will be the most significant change in cybercrime over the next five years. BEC is particularly suited for these tactics because it depends entirely on manufactured trust.
Attack Lifecycle and Detection Challenges
The attack process typically begins with reconnaissance, where adversaries gather details about target names, roles, and internal relationships. Attackers may use adversary-in-the-middle techniques to intercept credentials before taking over an email account through phishing or software exploits. Once in control, they impersonate executives or vendors to deceive employees into transferring funds or sharing sensitive data.
Traditional security tools and spam filters often fail to catch these attempts because the emails appear legitimate at first glance. The attacks rely on social engineering rather than malicious payloads, meaning recipients may not suspect foul play until financial damage occurs. Without close inspection of contact details, the deception remains effective.
What should you do?
Organizations should monitor for unusual email requests, particularly those involving urgent payment instructions or sensitive data transfers. Security teams need to verify the source of high-value transactions through secondary channels that do not rely on the compromised email account.
Background: Generative AI
Generative AI examples include text completion, image synthesis and code generation. These systems predict the next likely token based on vast training datasets. Understanding the underlying mechanics helps you identify risks like data leakage and hallucination in your infrastructure.
Read the full guide: Generative AI Examples: Mechanisms, Risks and Control
What to do and how to stay safe: Huntress
- Train employees to scrutinize sender addresses and contact details for subtle discrepancies that indicate spoofing.
- Implement multi-factor authentication to protect email accounts from unauthorized access and credential theft.
- Establish a verification protocol for any request to change payment details or transfer funds outside normal processes.
- Monitor user activity for signs of account takeover, such as logins from unfamiliar locations or devices.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is business email compromise?
BEC is a phishing scam where attackers impersonate trusted sources to trick recipients into sending money or sensitive information.
How much do BEC attacks cost globally?
These attacks result in approximately $55 billion in losses worldwide, a figure that Huntress expects to rise.
Why are BEC attacks hard to stop?
They rely on social engineering and AI-generated content that mimics trusted contacts, bypassing traditional spam filters.
