Topic starter
27/06/2026 2:01 pm
TL;DR: Business email compromise caused $2.8 billion in losses in 2024 and has reached $17.1 billion since 2015, while attack volume rose 54% year over year as generative AI makes fraudulent messages harder to spot, according to Abnormal AI and the FBI IC3 Internet Crime Report. Plain-text, legitimacy-based attacks now expose the limits of email gateways and training alone.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “Why BEC Remains the $2.8 Billion Problem CISOs Can’t Ignore”.
By the numbers:
- Abnormal AI says business email compromise attack volume rose 54% between 2023 and 2024.
Key questions
Q: What breaks when email security only scans attachments?
A: Attachment-only DLP misses the most common modern leak paths: data pasted into message bodies, screenshots, and text copied into AI tools.
Q: Why does generative AI make business email compromise harder to detect?
A: Generative AI removes the language mistakes and awkward phrasing that once helped people spot fraudulent messages.
Q: How should organisations verify high-risk requests that arrive by email?
A: Use an independent confirmation step outside the email thread for payments, vendor changes, payroll updates, and other high-impact actions.
Practitioner guidance
- Harden approval workflows for payment and vendor changes Require out-of-band confirmation for wire transfers, payroll edits, bank detail changes, and other high-impact financial requests before they are executed.
- Add behavioural signals to email defence Correlate mailbox rule changes, risky sign-ins, unusual thread patterns, and sender-history anomalies to flag requests that look legitimate but do not fit normal communication behaviour.
- Segment privileged communication paths Separate executive, finance, and HR request handling from ordinary inbox workflows so a single convincing email cannot trigger an irreversible action.
Bottom line: Business email compromise succeeds because it exploits trust and business process legitimacy, not malware delivery.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 3:36 pm
Business email compromise is now a governance problem, not just a mail-security problem. The article shows that BEC succeeds because organisations still treat trust as an informal human judgement rather than a verifiable control point. When a request can be legitimate-looking, plain text, and domain-correct, the control surface shifts from the message to the identity and relationship behind it. Practitioners should treat high-risk email requests as identity governance events, not just inbox events.
A question worth separating out:
Q: When should organisations prioritise automated BEC detection over employee awareness training?
A: Once messages are AI-polished and embedded in normal business workflows, automated detection should take priority because training cannot reliably distinguish legitimate-looking fraud at scale. Awareness still matters, but it should support machine-enforced controls rather than carry the primary burden alone.
👉 Read our full editorial: Business email compromise is outpacing legacy email defenses