Email fraud losses are rising: are DMARC controls keeping up?

TL;DR: Email-origin fraud tied to BEC, phishing and government impersonation exceeded $4 billion in IC3-reported losses, while AI made spoofed messages harder to detect and Red Sift’s regional research found many top US organisations still lack full DMARC enforcement. Technical sender authentication, not human pattern recognition, is now the decisive control.

Editorial analysis by NHI Mgmt Group, based on content published by Red Sift: “FBI IC3 2025 report: Email fraud is now a $4 billion problem”.

By the numbers:

• The FBI’s IC3 logged over one million complaints and $20.8 billion in losses in 2025.
• Across BEC, phishing and government impersonation, losses exceeded $4 billion, up 46% from 2024.

Key questions

Q: How should security teams reduce phishing risk when AI makes scam messages more convincing?

A: Teams should stop relying on obvious spelling mistakes and train people to verify the sender, destination, and request through a separate channel.

Q: When does DMARC monitoring stop being enough?

A: Monitoring stops being enough when spoofed mail can still reach users and trigger action.

Q: What breaks when finance workflows still trust incoming email?

A: Finance workflows break when urgent requests, invoice changes and approval chains are allowed to start from unauthenticated or weakly authenticated email.

Practitioner guidance

• Enforce DMARC at p=reject across all corporate domains Close the spoofing path at the domain layer rather than leaving malicious mail to be judged by recipients or downstream filters.
• Inventory every legitimate sender before tightening policy Build a current list of third-party platforms, marketing tools, SaaS services and internal mail streams so SPF and DKIM alignment does not break business mail.
• Protect finance and executive workflows with callback verification Require out-of-band confirmation for wire transfers, bank-detail changes and urgent payment requests, especially when the request originates by email.

Bottom line: Email fraud now succeeds as a trust problem, not just a content problem, because AI removes the cues people used to spot impersonation.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →