Business Email Compromise Rolling Intelligence Card

Business email compromise is a coordinated failure of identity trust and financial control, not merely an email-filter problem. Microsoft’s newest Q2 telemetry shows why raw volume needs interpretation: April surged 121% from March to nearly 9 million BEC attacks, then fell to 3.4 million in May and 3.9 million in June. Microsoft attributes the spike to a small number of high-volume campaigns rather than a durable doubling of the threat. Generic outreach still dominated 87–92% of initial contact, so the attacker usually tests a trusted conversation before asking for money or documents.[7]Evidence dated Jul 23, 2026

Automation is making those conversations scalable. On June 1, Microsoft observed one actor reach more than 67,000 users at over 42,000 organizations in under three hours. Python-generated messages were sent through Amazon SES from a DKIM-configured domain, passed SPF and DKIM, contained no malicious link or attachment, targeted role mailboxes such as accounts receivable, HR, and payroll, and used tracking pixels to identify recipients who opened the message. The lures sought aging reports and customer contacts before switching to payroll diversion.[7]Evidence dated Jul 23, 2026

Current incident-response evidence shows why a familiar sender and ordinary MFA cannot be treated as proof. Beazley reported that trusted-vendor impersonation—either through a genuinely compromised vendor account or a typosquatted domain—was the largest attack vector in its Q1 cases. Approximately 53% of responding organizations reported full or partial MFA, demonstrating that partially deployed MFA, session theft, and adversary-in-the-middle phishing can preserve an attacker’s access even after a user completes an authentication challenge.[3]Evidence dated May 12, 2026

Cofense’s finance-themed phishing analysis explains why awareness programs built around urgency and poor grammar are now incomplete. Across its Q1 2025–Q1 2026 observations, operational business language represented about 59%–79% of subject-line patterns, compared with 21%–41% for traditional urgency-oriented language; operational language reached 79% in Q1 2026. The practical risk is not a particular keyword. It is a message that fits the recipient’s routine: remittance advice, an invoice statement, a procurement request, an e-signature workflow, a contract revision, or a vendor follow-up that appears to continue work already in progress.[11]Evidence dated Jul 15, 2026

Microsoft’s April code-of-conduct campaign provides the concrete example. More than 35,000 users at over 13,000 organizations in 26 countries received staged compliance lures. The chain used PDFs, CAPTCHA gates, redirect infrastructure, and a proxy in front of the real sign-in page. The user saw and authenticated to Microsoft, but the proxy captured the resulting session token. That token could provide immediate mailbox access without asking the attacker to defeat MFA a second time.[2]Evidence dated May 4, 2026

A July Cofense Phishing Defense Center case shows how a trusted brand can create the access needed for later mailbox fraud. A fake Google Ads MMC synchronization notice used a non-Google sender, a Blogspot redirect, a newly created look-alike domain, and a JavaScript form imitating Google sign-in. Cofense did not claim that every recipient was compromised or that the campaign produced BEC loss. Its value here is the observable sequence: familiar business-service maintenance, staged legitimacy, credential capture, and potential account takeover.[13]Evidence dated Jul 21, 2026

Cofense’s platform-aware delivery research widens that precursor view. The observed kits collected browser, operating-system, language, local time, time zone, screen dimensions, and geolocation, then varied delivery across Windows, macOS, and Android. One campaign can therefore present a remote-access tool to one user and a credential-harvest page to another while sharing the same lure and infrastructure. Email, endpoint, identity, and mobile telemetry must be correlated as one campaign rather than triaged as unrelated device-specific events.[14]Evidence dated Jul 1, 2026

Cash-out data shows that BEC ranges from routine-looking gift-card requests to material wire fraud. APWG’s Q1 report, using Fortra analysis, recorded gift cards as 48% of observed cash-out methods, wires as 19%, and payroll diversion as 11%; the average requested wire was $42,663. Fortra’s June engagements then showed a 22% monthly rise in engagement volume, gift cards at 59.9%, and an average requested wire of $71,295. Those datasets are related but time-bounded: the useful conclusion is that finance controls must cover both frequent low-friction requests and less frequent high-severity transfers.[1][5]First cited source May 21, 2026 · Latest cited source Jul 8, 2026

Infrastructure indicators help investigations but do not solve the process weakness. APWG and Fortra both observed 72% of BEC delivery through free webmail in their respective periods, while Fortra also identified 1,318 maliciously registered domains in June. A company that only monitors look-alike domains will miss the larger free-webmail problem; a company that only filters external senders may still lose money when a legitimate vendor mailbox or authenticated employee session is compromised.[1][3][5]First cited source May 12, 2026 · Latest cited source Jul 8, 2026

The loss profile is serious even when the business never experiences encryption or visible downtime. Verizon’s study of 3,934 BEC insurance claims from 2019–2024 found a median loss in the mid-$50,000s, occasional losses near $10 million, and response or recovery activity in 64% of claims. The claims are historical, but the study was published inside this rolling window and provides a useful executive impact baseline for budgeting approval controls, incident response, legal work, and recovery support.[6]Evidence dated Jun 2026

The victimology follows money and trusted relationships. Beazley’s largest Q1 concentration was professional services plus financial institutions at 37% of investigated BEC cases. Microsoft’s April campaign was 92% U.S.-targeted and concentrated in healthcare, financial services, professional services, and technology. Verizon’s claims data also shows BEC appearing across healthcare, manufacturing, retail, public administration, and smaller organizations, where a mid-five-figure loss can be especially disruptive.[2][3][6]First cited source May 4, 2026 · Latest cited source Jun 2026

Official case evidence adds a practical recovery boundary without changing prevalence. The North Dakota U.S. Attorney’s Office and FBI reported seizure of $4,856,578.51 fraudulently obtained from Dickinson Public Schools after tracing the funds to a Citibank account, while a separate Western District of Virginia plea described a $3 million-plus BEC scheme in which compromised payee email accounts redirected legitimate wire payments to personal and illegitimate business accounts. Those cases reinforce the need to preserve evidence, trace funds, and escalate through banks and law enforcement immediately.[8][9]First cited source Apr 30, 2026 · Latest cited source Jun 25, 2026

Cofense’s two 2026 webinar summaries sharpen how the program should be measured. AI-assisted variation changes sender data, URLs, attachments, hashes, language, and subject lines while preserving the campaign objective, so blocking one indicator is temporary. The defensible operating model combines employee reporting, campaign-level correlation, expert validation, automated remediation, and post-delivery containment; measures reporting rate, time to classify, time to remediate, dwell time, repeat exposure, and false-positive/false-negative trends; and keeps human authority over consequential action.[12][15][16]First cited source Jun 16, 2026 · Latest cited source Jul 23, 2026

The management standard is therefore joint ownership. Finance must independently verify bank, payroll, gift-card, cryptocurrency, aging-report, and customer-data requests—even when SPF and DKIM pass, the prose looks professional, and there is no link to inspect. Identity teams must deploy phishing-resistant authentication and revoke sessions; security must preserve sign-in, mailbox, rule, OAuth, message, endpoint, and campaign-correlation evidence; and leadership must preauthorize bank, insurer, counsel, and law-enforcement escalation. The first response must run in minutes because recovery becomes harder after funds leave the first mule account or layered account path.[1][2][3][4][5][6][7][8][9][11][12][13][14][15][16]First cited source Apr 30, 2026 · Latest cited source Jul 23, 2026