Topic starter
14/07/2026 4:23 pm
TL;DR: Business email compromise has driven more than US$55 billion in attempted or actual losses across over 300,000 attacks since 2013, and attackers now combine compromised accounts, thread hijacking, and AI-generated social engineering to bypass content filters, according to Proofpoint. The problem is no longer email filtering alone, but trust, identity, and workflow abuse that conventional controls were never built to stop.
Editorial analysis by NHI Mgmt Group, based on content published by Proofpoint: “How to Prevent Business Email Compromise (BEC) Attacks”.
By the numbers:
- Business email compromise has led to more than US$55 billion in attempted or actual losses worldwide since 2013.
Key questions
Q: What breaks when BEC controls rely only on email filtering and DMARC?
A: Filtering and DMARC reduce spoofing, but they do not stop attacks that use compromised accounts, thread hijacking, or messages that fit the normal conversation context.
Q: Why do compromised mailboxes make BEC harder to detect?
A: A compromised mailbox carries the trust of a real person, vendor, or executive, so the attacker can send requests from a context recipients already accept.
Q: What are the warning signs that BEC controls are too weak?
A: Warning signs include approvals happening only through email, inconsistent verification for payment or access changes, and a lack of separation between routine communication and sensitive business actions.
Practitioner guidance
- Map high-risk communication paths Identify which roles, vendors, and request types routinely trigger money movement, account changes, or sensitive-data sharing, then apply extra verification to those paths.
- Add identity checks to approval workflows Require independent confirmation for payment changes, bank-detail updates, executive requests, and other high-impact actions before they are executed.
- Monitor for mailbox compromise signals Watch for abnormal login patterns, new inbox rules, conversation insertion, and unexpected changes in sending behaviour across Microsoft 365 and similar environments.
Bottom line: BEC succeeds because attackers abuse trust, not just inboxes, which makes identity and workflow control more important than message filtering alone.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/07/2026 5:06 pm
BEC is now a governance problem, not an email-filtering problem. The article shows that attackers win by abusing trusted relationships, timing, and normal business process, which means the control failure sits above the message layer. Authentication and filtering still matter, but they do not validate whether a request is contextually legitimate. For identity teams, this is a reminder that trust decisions belong in process controls, not only in transport or content controls.
A few things that frame the scale:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
- Businesses report a 200% surge in attempted deepfake-aided wire fraud in Q1 2025 alone.
A question worth separating out:
Q: How should financial institutions verify high-risk requests without slowing operations too much?
A: Use tiered verification for requests that can move money, reset credentials or expose sensitive data. Low-risk activity can follow normal workflow, but high-risk actions should require a separate callback, a second approver or a known trusted channel. The goal is to make urgency irrelevant when identity and authority are being asserted.
👉 Read our full editorial: Business email compromise is exploiting trust and process gaps