Email fraud outpaces legacy filters as SMB losses rise

At a glance

What this is: At-Bay’s analysis says email fraud is still slipping past legacy security controls, with lookalike domains, suspicious headers, and behavioural anomalies driving losses for SMBs.

Why it matters: This matters because email fraud is both an identity-trust problem and a financial control problem, so IAM, fraud, and security teams need shared detection and escalation paths.

By the numbers:

• Since 2021, financial fraud frequency has jumped by 55%.

Context

Email fraud succeeds when attackers exploit human trust faster than email controls can verify sender legitimacy. The core governance gap is that many organisations still treat inbound email as a delivery problem, not a trust-and-authorisation problem, even though payment instructions and executive requests can trigger real financial loss.

For SMBs, the gap is wider because dedicated fraud teams, tuning capacity, and layered verification workflows are often limited. That makes email fraud both a security issue and an operational controls issue, which is why the identity and fraud boundary matters more here than in a routine phishing discussion.

Key questions

Q: What should teams do first when email fraud is slipping past inbox security?

A: Start by adding an out-of-band verification step for any request that changes payment details, requests a wire transfer, or pressures staff to bypass normal checks. Email security alone cannot prove intent, so the first control should be a human approval step that forces confirmation through a separate trusted channel before money or sensitive information moves.

Q: Why do lookalike domains and urgent payment requests create such high fraud risk?

A: Because they combine sender impersonation with time pressure, which reduces the chance that staff will challenge the request. The domain may look close enough to pass casual review, and the message can still fit ordinary business language. That makes the real vulnerability the decision process, not just the inbox filter.

Q: What are the signs that email trust controls are failing?

A: Repeated replies to suspicious requests, high forward rates, weak reporting discipline, and inconsistent escalation around vendor changes are all warning signs. If analysts see lots of noise but few confirmed reports, attackers may be succeeding because the organisation is not distinguishing routine messages from risky ones quickly enough.

Q: How do finance, security, and operations teams share accountability for preventing fraud and business email compromise?

A: Accountability should be shared but explicit. Finance owns payment verification, dual approval, and vendor change controls. Security owns monitoring, awareness training, and identity protections around email and financial systems. Operations should support documented escalation paths and incident reporting. When responsibilities are written down and rehearsed, organizations reduce the chance that a fraudulent request slips through a gap between teams.

Technical breakdown

How lookalike domains bypass normal email trust checks

Attackers register domains that differ by one or two characters from trusted brands, then use them to impersonate vendors, executives, or payment teams. Delivery systems may see the message as valid mail, but the real control failure is that legitimacy is inferred from syntax rather than domain history, sender reputation, and expected business context. A good control stack needs to evaluate who sent the message, whether that sender relationship is plausible, and whether the request fits the normal pattern of the business process. Practical implication: validate high-risk requests against identity signals, not just mail transport checks.

Practical implication: Treat domain similarity as a fraud signal, not just an email hygiene issue.

Why message behaviour matters more than subject line keywords

Fraud often appears as urgency, timing anomalies, or instructions to bypass normal verification. A midnight wire request or a sudden change in payment instructions can look harmless to a content filter but still be highly risky when compared with ordinary sender behaviour. Behavioural analysis is useful because it tests the request against the relationship, the timing, and the expected workflow, not just against a blacklist. In practice, that is closer to a fraud-control model than a traditional spam model. Practical implication: add behavioural rules and case review for payment and executive impersonation requests. See the Fraud and Cyber Convergence Guide.

Practical implication: Use behavioural signals to flag requests that violate normal business communication patterns.

Why legacy email security misses the control point

Legacy email security is often designed to detect malware, spam, or obvious phishing markers, but email fraud can be socially engineered to look operationally normal. That means the message may pass inbox controls even while it is preparing a human to authorise a transfer, change banking details, or disclose sensitive information. The control point is not just at the inbox gateway; it is also at the decision moment inside finance, procurement, and executive workflows. Practical implication: pair email filtering with approval checks and out-of-band verification for payment changes.

Practical implication: Move protection closer to the authorisation step, where financial damage actually occurs.

Threat narrative

Attacker objective: The attacker’s objective is to convert email trust into financial fraud or operational disruption before the request is challenged.

1. Entry occurs through a convincing email that imitates a trusted sender, a known vendor, or an executive request.
2. Credential or trust abuse follows when the recipient relies on the message context and responds without out-of-band verification.
3. Impact occurs when a fraudulent wire transfer, invoice change, or sensitive disclosure is approved and the organisation absorbs the loss.

Breaches seen in the wild

• Zacks breach claim 2025: A hacker leaked 12 million Zacks accounts in 2025, claiming domain admin access in 2024; HIBP verified the data, Zacks has not confirmed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Email fraud is a trust governance problem, not just a mail security problem. The article shows that the message itself can be structurally valid while the business request is fraudulent. That shifts the control question from blocking mail to validating intent, sender legitimacy, and approval context. Practitioners should treat email fraud as a cross-functional identity and finance risk, not a helpdesk nuisance.

Fraud detection becomes a control layer over business authorisation when email is the trigger. The most dangerous messages are not necessarily malicious-looking; they are operationally plausible requests that exploit routine workflows. This is where fraud and cyber convergence matters, because security teams need shared signals with finance and operations to catch impersonation before payment is released. Practitioners should align detection, case management, and escalation around the business action being requested.

Legacy email filters create a false sense of coverage when the attacker is targeting human decision-making. The article’s examples show how lookalike domains, reputation, and behavioural anomalies evade controls built mainly for spam and malware. That pattern supports a named concept: authorisation-layer fraud exposure, where the weak point is the moment a human authorises an action, not the moment a message arrives. Practitioners should place stronger controls at the authorisation layer.

Identity signals should sit inside fraud workflows when financial requests are involved. A suspicious sender, a new domain, or an abnormal reply path is not just email telemetry; it is an identity-trust indicator that should influence approval decisions. That is especially true in SMB environments, where limited staff and fewer manual checks increase the chance of a fast compromise. Practitioners should integrate identity-aware review into fraud response.

From our research library:

• U.S. fraud losses are projected to reach $40 billion by 2027.

What this signals

Authorisation-layer fraud exposure: email fraud is most dangerous when the request is credible enough to reach a human approver. That means controls have to move beyond inbox hygiene and into the approval path, where finance, procurement, and executive workflows can still stop the loss before any transfer is executed.

For SMBs, the practical challenge is not identifying every suspicious message but deciding which requests deserve a second look before they become business actions. A mature programme treats email trust, sender history, and payment verification as one control surface rather than separate problems.

For practitioners

• Implement out-of-band verification for payment changes Require a second channel check for any new wire instruction, banking detail change, or high-value transfer request before approval is granted.
• Tune detection for lookalike and newly registered domains Prioritise domain similarity, registration age, reputation history, and sender impersonation rules for messages that request money movement or sensitive changes.
• Add behavioural review to executive impersonation alerts Flag urgent requests, off-hours sending, unusual reply-to addresses, and language that discourages verification as case-review triggers.
• Build a shared fraud escalation path Route suspicious email requests into a joint workflow for security, finance, and operations so approvals can pause before funds or data move.
• Measure fraud control effectiveness by stopped requests Track how many fraudulent emails are blocked before user action, how many are escalated, and how many are confirmed as attempted financial fraud.

Key takeaways

• Email fraud remains effective because it targets human approval workflows, not just email infrastructure.
• At-Bay’s figures point to material losses and rising frequency, which makes detection quality a finance issue as much as a security issue.
• The strongest compensating control is out-of-band verification tied to payment and account-change requests.

Related NHI Mgmt Group resources: Identity Fraud Prevention Guide · Fraud and Cyber Convergence Guide

Key terms

• Email Fraud: Email fraud is the use of deceptive messages to impersonate trusted senders and trick recipients into taking harmful action. It commonly includes business email compromise, account takeover, and spoofed brand communication, and it succeeds when authentication controls, user awareness, and operational feedback loops are weak.
• Lookalike Domain: A lookalike domain is a web address designed to resemble a trusted brand closely enough to trick users into believing it is legitimate. In identity attacks, the domain becomes part of the deception layer, letting attackers capture credentials, identity details, or payments through a counterfeit flow.
• Out-Of-Band Verification: A confirmation step that uses a different channel or method than the original request. It reduces the chance that a single spoofed email, voice call, or video session can authorize privileged activity or financial transfer.
• Authorisation Layer Fraud Exposure: Authorisation layer fraud exposure is the condition where a fraudulent message succeeds because it reaches a real decision point inside a business workflow. The weakness is not the inbox alone, but the approval step where money, access, or sensitive data can still be released.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It helps practitioners connect identity controls to broader security decisions across modern environments.