Topic starter
27/06/2026 1:20 pm
TL;DR: Cybercrime losses exceeded $10 billion in 2022, with investment fraud leading and business email compromise close behind, while AI is expected to push losses higher in the short term, according to Abnormal AI’s webinar briefing and Secret Service predictions. The signal for identity teams is that email compromise is now an identity and trust problem, not just a messaging problem.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “Pig Butchering, BEC, and More: Cybercrime Predictions for 2024”.
Key questions
Q: How should teams reduce business email compromise risk in approval workflows?
A: Teams should treat approval workflows as identity checkpoints, not just communications channels.
Q: Why does AI make fraud losses harder to contain?
A: AI lowers the cost of producing convincing impersonation at scale.
Practitioner guidance
- Reclassify BEC as a trust-control problem Map the email-triggered workflows that can move money, change beneficiary data, or alter vendor payment details without independent verification.
- Add verification to high-risk approvals Require out-of-band confirmation for payment requests, bank detail changes, and urgent executive instructions before any downstream action is taken.
- Tighten mailbox and identity monitoring Correlate anomalous sender behaviour, unusual login context, and message-thread manipulation so fraud teams can spot identity abuse earlier.
Bottom line: Cybercrime losses are climbing because fraud models increasingly exploit identity trust, not just technical compromise paths.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
27/06/2026 2:39 pm
BEC is now an identity governance problem, not only an email security problem. The article’s core signal is that business email compromise succeeds where organisations allow trust in sender identity to stand in for proof. That is a governance failure because the business process accepts identity claims without an independent control layer. The practical conclusion is that email controls and IAM controls have to converge at the decision point, especially for financial workflows.
A few things that frame the scale:
- Businesses report a 200% surge in attempted deepfake-aided wire fraud in Q1 2025 alone.
A question worth separating out:
Q: Which teams are accountable for reducing BEC and investment fraud losses?
A: Accountability usually spans security, identity, finance, and business operations because the failure sits in the workflow, not a single tool. Security may monitor signals, but finance owns payment controls and business leaders own approval discipline. Frameworks that support this view are the ones that tie access, verification, and segregation of duties together.
👉 Read our full editorial: Cybercrime losses, BEC, and AI: why fraud losses keep climbing
This post was modified 4 days ago by NHI Mgmt Group