Topic starter
25/10/2026 11:06 am
TL;DR: $4 billion in IC3-reported losses tied to BEC, phishing and government impersonation show how email fraud scales when spoofed messages are harder to spot, Red Sift data found. Sender authentication and separate payment checks now matter more than human pattern recognition.
Editorial analysis by NHI Mgmt Group, based on content published by Red Sift: “FBI IC3 2025 report: Email fraud is now a $4 billion problem”.
By the numbers:
- The FBI’s IC3 logged over one million complaints and $20.8 billion in losses in 2025.
- Across BEC, phishing and government impersonation, losses exceeded $4 billion, up 46% from 2024.
Key questions
Q: When does DMARC monitoring stop being enough?
A: Monitoring stops being enough when spoofed mail can still reach users and trigger action.
Q: What breaks when finance workflows still trust incoming email?
A: Finance workflows break when urgent requests, invoice changes and approval chains are allowed to start from unauthenticated or weakly authenticated email.
Q: How should security teams reduce phishing risk when AI makes scam messages more convincing?
A: Teams should stop relying on obvious spelling mistakes and train people to verify the sender, destination, and request through a separate channel.
Practitioner guidance
- Enforce DMARC at p=reject across all corporate domains Close the spoofing path at the domain layer rather than leaving malicious mail to be judged by recipients or downstream filters.
- Inventory every legitimate sender before tightening policy Build a current list of third-party platforms, marketing tools, SaaS services and internal mail streams so SPF and DKIM alignment does not break business mail.
- Protect finance and executive workflows with callback verification Require out-of-band confirmation for wire transfers, bank-detail changes and urgent payment requests, especially when the request originates by email.
Bottom line: Email fraud now succeeds as a trust problem, not just a content problem, because AI removes the cues people used to spot impersonation.
Glossary terms: Domain-based Message Authentication, Reporting & Conformance (DMARC), Business email compromise, Sender Authentication, Email-origin Fraud
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:14 pm
Email authentication has become a governance control, not a mail-admin setting. Once AI can imitate tone, style and voice, the remaining question is not whether a message sounds plausible but whether the domain is authorised to send it. That moves DMARC, SPF and DKIM into the same governance conversation as identity assurance and fraud control. Practitioners should treat sender identity as policy-enforced infrastructure, not user intuition.
A few things that frame the scale:
- The FBI’s 2025 Internet Crime Report documented $893 million in AI-related fraud losses.
A question worth separating out:
Q: What should organisations do after a suspected spoofing or BEC event?
A: They should contain the mailbox, search for related messages, revoke any stolen session tokens, review sender rules and alert affected staff immediately. Post-incident work should also identify which sender domains lacked enforcement, because the same gap will be reused if it is not closed.
👉 Read our full editorial: AI is widening email fraud losses while DMARC gaps remain
This post was modified 7 days ago by NHI Mgmt Group