What the numbers say, and what they miss
IC3 defines BEC as a scam aimed at businesses, or at people who work with vendors or regularly make wire payments. Criminals compromise email and other channels, including phone numbers and virtual meeting applications, through social engineering or computer intrusion, in order to make unauthorized fund transfers.
In its latest annual report, IC3 logged 24,768 BEC complaints and $3,046,598,558 in losses. By loss, only investment fraud ranked higher. By complaint count, BEC ranked ninth, which tells you what kind of crime it is: fewer victims than the high-volume scams, far more money per case. These are complaints reported in the United States, so they reflect only what victims chose to report and say nothing about other jurisdictions.
AI appears in the report, but modestly. Businesses reported 135 BEC complaints with an AI link, worth $30,256,592. That is about 1% of BEC losses. IC3 notes that chat generators can produce official-sounding messages that impersonate executives, and that voice cloning can be used to request wire payments. On this evidence, AI makes impersonation cheaper. It has not yet changed where most of the money is lost.
Speed matters after the fact. Across all the incidents the FBI’s Recovery Asset Team handled, not BEC alone, it worked 3,900 cases involving about $1.16 billion in attempted theft and froze about $679 million, a 58% success rate. The report does not give a BEC-only figure.
The chain behind the fraud
Microsoft Defender researchers documented two campaigns that show how much happens before any money moves. One targeted banking and financial services organizations. The other targeted energy-sector organizations. Both began with a compromised trusted vendor.
| STAGE | WHAT THE ATTACKER DID | WHERE A CONTROL CAN BREAK THE CHAIN |
|---|---|---|
| Trusted entry | Phishing arrived from a vendor’s real account. In the first case the subject carried a unique seven-digit code per target and linked to a fake document preview on a legitimate design platform. In the second, a SharePoint sign-in link resembled a normal document-sharing notice. | Remove blanket allow rules for vendor mail. Microsoft found some targets automatically allowed vendor email, which let the messages through. |
| Session capture | A fake Microsoft sign-in page collected the password, ran a live session with the real service, and relayed the MFA response to capture the session token. The stolen cookie was replayed hours later from a different IP address. | Phishing-resistant authentication such as FIDO2 keys, conditional access, and continuous access evaluation. |
| Persistence | The attacker added a phone-based one-time-password method to the account. No fresh authentication was required. | Require re-authentication to change MFA methods, and alert on every method change. |
| Concealment | An inbox rule moved all incoming mail to Archive and marked it read (first case), or deleted it and marked it read (second case). The attacker deleted bounces and out-of-office replies, and answered doubtful recipients to vouch for the messages. | Alert on rule creation that hides mail. Review rules during any suspected compromise. |
| Expansion | More than 16,000 emails went out from the first victim’s mailbox, and more than 600 from the second, using real threads and distribution lists. Recipients who clicked faced a second AiTM attack. | Containment must include the people who received mail from the account, inside and outside the organization. |
These campaigns used the mailbox to spread compromise. The IC3 definition describes the fraud end of the same access: unauthorized transfers of funds. One compromised mailbox can support both. An attacker who already reads vendor and finance conversations has no need to guess when a payment is due.
Why “beyond phishing” matters
The mailbox is the weapon. Real threads give the attacker credibility no spoofed address can match. They reply in context, to people who expect the reply.
Concealment is part of the design. The inbox rules and the deleted bounces are not side effects. They keep the account owner, and the vendor on the other end, from seeing anything wrong.
The attack crosses company lines. Because it travels through trusted vendor relationships, the first sign of a BEC against you can be a message from a partner. The reverse is also true: your compromised mailbox becomes someone else’s trusted sender.
The last control sits outside security. Mail filtering can stop some entry attempts. What stops a fraudulent payment is a finance process that does not accept a bank-detail change, or an urgent payment request, just because it arrived in an existing thread. That is industry practice rather than a finding from the sources above, but it follows directly from how these attacks work.
What should change
| AREA | CHANGE |
|---|---|
| Detection | Alert on inbox rules that move, delete or mark mail as read, and on new MFA methods. Monitor sign-ins for unusual locations, ISPs, user agents or anonymizing services, the signals Microsoft names. |
| Authentication | Move high-risk users to FIDO2 keys, certificate-based authentication or equivalent. Apply risk-based conditional access and continuous access evaluation. Re-challenge on any MFA change. |
| Mail flow | Review policies that automatically allow vendor email. Treat file-sharing notices from partners with the same scrutiny as any other link. |
| Finance process | Verify bank-detail changes and unusual payment requests through a channel the attacker does not control, such as a call to a number from existing records. Do not rely on the thread in which the request arrived. Require a second approver above a set value. |
| Response | Do not stop at a password reset. Revoke active session cookies, reverse attacker-made MFA changes, delete malicious inbox rules, and review OAuth grants on the account, since attackers have used OAuth-authorized add-ons to delete security notifications. Then identify everyone who received mail from the account. |
| Escalation | Give security and finance one shared escalation path for suspected BEC, and bring the bank in early. The Recovery Asset Team figures show that frozen funds are possible. |
Where to apply this
Click rates measure the first stage only. A more useful exercise runs the whole chain: does the security team see a new inbox rule within minutes, does the account’s MFA change trigger an alert, and does finance verify a bank-detail change that arrives inside a trusted thread? Each answer shows a different control, and a different owner.
Sources
-
Federal Bureau of Investigation, Internet Crime Complaint Center. Internet Crime Report (latest annual edition) ic3.gov
-
Microsoft Threat Intelligence. Detecting and mitigating a multi-stage AiTM phishing and BEC campaign microsoft.com
-
Microsoft Threat Intelligence. Multistage AiTM phishing and BEC campaign abusing SharePoint microsoft.com
-
Mandiant. Proactive Defense Against ShinyHunters-Branded Data Theft Targeting SaaS
How we label evidence
Facts carry a source. Analysis and recommendations are marked as ours. Examples that are hypothetical are labeled as hypothetical.
Part of the solutionProtect What MattersGuard the identities, data and systems the business depends on.See how we work →Related service
Phishing Operations
Use this to test and improve phishing resilience.