Business email compromise did not politely knock on the office door in June 2025. It barged in, borrowed the chief financial officer’s writing style, and asked accounting to “handle something urgently.” According to Fortra’s June 2025 threat research, observed BEC attack volume climbed 37 percent from May, signaling a sharp month-over-month acceleration in one of cybercrime’s most financially damaging schemes.
The increase matters because business email compromise, or BEC, is not ordinary spam. These attacks impersonate executives, employees, vendors, attorneys, banks, or other trusted contacts to steal credentials, redirect payroll, alter invoices, obtain sensitive records, or persuade someone to send money. Many messages contain no malware and no obviously suspicious attachment. The weapon is a believable business conversation.
The June findings reveal an important shift: attackers increasingly prioritized credential theft and flexible payment schemes rather than relying exclusively on spectacular six-figure wire requests. In other words, criminals appear to be building a diversified fraud portfolio. Unfortunately, nobody invited them to the quarterly strategy meeting.
What Does the 37 Percent Increase Actually Mean?
The headline refers to a 37 percent increase in overall BEC attack volume during June 2025 compared with May 2025. It is a month-over-month measurement, not a claim that every organization experienced exactly 37 percent more malicious email.
The figure comes from attacks analyzed by Fortra’s Intelligence and Research Experts. It should therefore be treated as a view into the activity observed within that research environment rather than a complete census of every BEC message sent worldwide. Even with that limitation, such a large monthly jump is meaningful because it reflects what defenders were encountering in active campaigns.
The broader environment was already busy. The Anti-Phishing Working Group counted more than one million phishing attacks during the first quarter of 2025, its highest quarterly total since late 2023. It also reported that observed wire-transfer BEC attacks rose 33 percent from the preceding quarter. June’s increase was therefore not an isolated thundercloud appearing in an otherwise sunny inbox.
Key Finding 1: Credential Phishing Dominated BEC Activity
Credential phishing represented 46.2 percent of the cash-out methods identified in June, making it the largest category by a substantial margin. Gift card requests followed at 16.2 percent, while advance-fee schemes accounted for 10.3 percent. Payroll diversion represented 1.8 percent, wire transfers 1 percent, cryptocurrency 0.6 percent, and vishing 0.4 percent. Another 23 percent involved assorted payment or fraud requests.
Describing credential phishing as a “cash-out method” may initially sound odd because a stolen password is not a stack of dollar bills. Its value lies in what comes next. Access to a real mailbox can allow a criminal to study invoices, identify decision-makers, search for payment schedules, create forwarding rules, reset accounts, and enter legitimate conversations at exactly the right moment.
Once inside, the attacker does not need to imitate an employee from the outside. The message can arrive from the employee’s actual account, complete with genuine signatures, previous replies, contact history, and familiar language. This makes conversation hijacking especially dangerous. A fraudulent bank-account change inserted into a legitimate invoice thread is much harder to recognize than a random message announcing that the CEO suddenly needs twenty gift cards before lunch.
Proofpoint’s 2025 research similarly emphasized the challenge posed by payload-free social engineering. BEC messages and conversational lures often exploit trust without delivering malware, while generative AI can help criminals produce more polished, localized, and personalized language at scale.
Key Finding 2: Wire Requests Became Smaller, Not Harmless
Fortra observed a 12 percent decline in wire-transfer BEC attacks during June. The average requested transfer fell from $96,200 in May to $71,054 in June, a reduction of 26 percent. Eighty-one percent of the observed wire requests were between $10,000 and $50,000, 8 percent were below $10,000, and 11 percent exceeded $100,000.
A lower average request should not be mistaken for good news. Smaller amounts may attract less scrutiny, fit more naturally into routine payment activity, and remain below internal approval thresholds. A $28,000 supplier invoice may look perfectly ordinary inside a company that processes dozens of similar payments each week.
Attackers can also distribute risk. Instead of gambling everything on one enormous transfer, they may attempt several moderate payments, payroll changes, gift card purchases, or credential thefts. This approach resembles a burglar choosing five unlocked side doors instead of arriving with a wrecking ball.
The FBI’s 2024 Internet Crime Report illustrates the financial stakes. IC3 received 21,442 BEC complaints with approximately $2.77 billion in reported losses during 2024. Complaint totals were relatively stable compared with the previous two years, yet losses remained enormous. Those figures include only incidents reported to the FBI, so they do not capture every victim or attempted attack.
Key Finding 3: Payroll Diversion Continued to Exploit Routine Processes
Payroll diversion occurs when an attacker impersonates an employee and asks human resources or payroll personnel to replace the employee’s direct-deposit information. The request may seem mundane: a new bank account, a changed routing number, or a request to update details before the next pay cycle.
In June, specialty banks were the most frequently identified institutions in payroll-diversion cases, representing 23 percent of the total. Major U.S. banks, regional banks, and online banks each accounted for 12 percent. International banks represented 6 percent, while credit unions accounted for 3 percent.
Payroll scams work because the request fits an established workflow. There may be no dramatic story, suspicious attachment, or demand for secrecy. The attacker simply asks an administrator to perform a task that administrator performs regularly. Without independent verification, efficiency can accidentally become the scammer’s favorite coworker.
Key Finding 4: Cryptocurrency Played a Smaller but Flexible Role
Researchers identified 24 cryptocurrency-related scams involving 14 unique wallets during June. The observed requests averaged approximately $1,430, ranging from $1,200 to $2,000. One tracked wallet had received roughly $3,247 in bitcoin across four transactions at the time of the analysis.
Cryptocurrency represented a small portion of the total BEC methods, but it remains attractive because transactions can move quickly across borders and may be difficult to reverse. A request for $1,500 in cryptocurrency might also encounter less organizational resistance than a $100,000 wire, especially when disguised as a vendor payment, urgent technical expense, or executive request.
Key Finding 5: Free Webmail Remained a Favorite Launchpad
Fifty-seven percent of the June attacks were sent through free webmail providers, while 43 percent originated from maliciously registered domains. In May, free webmail had represented 64 percent, so June showed a modest shift toward attacker-controlled domains.
Among 1,133 free webmail accounts associated with the attacks, Google-hosted accounts made up 66 percent. Microsoft and Verizon Media services were also represented. These figures do not suggest that the providers themselves were malicious. They show that criminals favor widely trusted, easy-to-create services that blend into normal traffic.
Malicious domains can support more convincing impersonation. A criminal might register a domain that differs from a supplier’s real address by one letter, a substituted character, or a different top-level domain. On a crowded mobile screen, “trustedvendor.co” can look uncomfortably similar to “trustedvendor.com.” Tiny typo, enormous invoice.
Email authentication technologies such as SPF, DKIM, and DMARC can reduce direct spoofing of a company’s domain. NIST recommends these mechanisms as part of a more trustworthy email environment, while the Federal Trade Commission encourages businesses to confirm that their email providers support all three. Authentication cannot stop every look-alike domain or compromised legitimate account, but it removes several easy options from the attacker’s toolbox.
Key Finding 6: Attacker Location Data Requires Careful Interpretation
About 31 percent of the June actors were linked to U.S.-based IP addresses, while Nigeria represented approximately 25 percent. However, Fortra explicitly cautioned that IP-derived locations are not definitive. Known VPN and proxy addresses were removed from the dataset, but compromised devices and less obvious relays can still distort geographic attribution.
This nuance is important. A U.S. IP address does not automatically mean the individual operating the campaign was sitting in the United States. Criminals routinely use cloud infrastructure, remote systems, residential proxies, and hijacked machines. Location statistics can help researchers identify patterns, but they should not be treated like a villain’s verified home address.
Why BEC Attacks Kept Working in 2025
Attackers Exploited Business Context
Modern BEC campaigns are often preceded by reconnaissance. Criminals review company websites, professional networking profiles, press releases, travel schedules, job descriptions, and public vendor relationships. They learn who approves payments, who manages payroll, and which executive is likely to send a terse email from an airport.
The FBI has warned for years that BEC groups study business habits and use company-specific language, authentic-looking invoices, and legitimate email threads. FinCEN has likewise described email compromise as an attack on vulnerable business processes, not merely a technical attack on inboxes.
Phishing Pages Became Better at Evading Inspection
In June 2025, Cofense documented credential-phishing campaigns that used long-established but compromised domains, custom CAPTCHA pages, anti-analysis code, and fake Microsoft Teams interfaces. The layered journey helped malicious pages avoid automated scanning while presenting victims with recognizable brands and familiar login screens.
Google’s threat researchers also documented campaigns targeting U.S. universities with malicious forms, copied login pages, compromised institutional resources, and lures timed around academic and financial deadlines. These campaigns illustrate how attackers combine trusted platforms with timely context to make payment-redirection and credential-theft attempts feel routine.
Organizations Still Relied Too Heavily on Employee Judgment
Verizon’s 2025 breach research found that the human element remained involved in roughly 60 percent of analyzed breaches, with overlap among social engineering, mistakes, and credential abuse. Meanwhile, Abnormal AI reported that employees at large enterprises frequently engaged with vendor-impersonation messages after reading them. Its research identified more than $300 million in attempted vendor email fraud over 12 months, while the reporting rate for advanced text-based threats was only 1.46 percent.
The lesson is not that employees are foolish. The lesson is that professionally written messages, authentic threads, familiar names, and believable requests can defeat a process that depends on one busy person noticing one subtle inconsistency.
Warning Signs of a Modern BEC Attack
Organizations should treat unexpected changes in payment instructions as high-risk events, even when the message appears to come from a known account. The most useful warning signs include a request to replace bank details, an unfamiliar reply-to address, an executive demanding secrecy, unusual urgency, a sudden preference for gift cards or cryptocurrency, and a vendor asking to move payment to a new institution.
Other clues are behavioral rather than technical. A normally formal executive may suddenly write “Are you available?” and avoid giving details. A supplier may refuse a phone call. An employee may request a payroll change from a personal account. A message may arrive at an unusual time or ask the recipient to bypass a standard approval step “just this once.”
None of these indicators proves fraud by itself. Together, however, they justify pausing the transaction and verifying the request through a separate channel.
How Organizations Can Reduce BEC Risk
Use Independent Payment Verification
Every new payee, bank-account change, payroll update, and unusual transfer should be verified using trusted contact information already stored in company records. Employees should not call the number supplied in the suspicious email. That number may lead directly to the attacker’s very professional “accounts receivable department,” complete with hold music and confidence.
High-value transactions should require approval from at least two authorized people. Organizations should also define cooling-off periods for changed payment details and configure alerts for new beneficiaries, first-time transfers, and deviations from established invoice patterns.
Deploy Phishing-Resistant Multifactor Authentication
MFA can reduce the damage caused by stolen passwords, but not every method offers equal protection. CISA recommends using phishing-resistant options, such as security keys, wherever possible. Number-matching authenticator applications are stronger than simple push approvals, while one-time codes delivered by text or email provide weaker protection.
Organizations should prioritize administrators, executives, finance teams, payroll staff, legal personnel, and employees with access to sensitive mailboxes. They should also review legacy authentication, inactive accounts, risky forwarding rules, suspicious OAuth permissions, and unusual sign-ins.
Improve Email Authentication and Behavioral Detection
SPF, DKIM, and DMARC should be correctly configured and monitored. Companies should gradually move DMARC toward an enforcement policy after confirming that legitimate senders are aligned. Defensive systems should also examine display-name impersonation, newly registered domains, reply-to mismatches, unusual mailbox behavior, and anomalous communication patterns.
Traditional filters remain useful, but BEC defense must consider intent and context. A clean email with no link can still be malicious when it asks a payroll administrator to replace an employee’s bank account.
Train Around Real Business Scenarios
Generic “do not click suspicious links” training is no longer enough. Exercises should include realistic invoice changes, executive impersonation, payroll diversion, vendor-thread hijacking, gift card requests, QR codes, fake collaboration notifications, and follow-up phone calls.
Training should also make reporting simple and psychologically safe. Employees who suspect a message should be rewarded for pausing, not criticized for slowing down a payment. A culture that worships speed and punishes verification is practically sending criminals a welcome basket.
What to Do Immediately After a BEC Payment
When money has been sent, minutes matter. The organization should contact its financial institution immediately, request a recall or hold, and ask the institution to notify the receiving bank. U.S. victims should also report the incident to the FBI’s Internet Crime Complaint Center and appropriate law-enforcement contacts.
The security team should preserve the original messages and headers, reset affected credentials, revoke active sessions, inspect forwarding and inbox rules, review delegated mailbox access, examine OAuth applications, and search for related messages across the organization.
Employees, vendors, insurers, legal counsel, and regulators may need to be notified depending on the data exposed and applicable obligations. The company should also determine whether the attacker merely impersonated an account or gained genuine access, because an active mailbox compromise can continue producing fraudulent messages long after the first payment is discovered.
Practical Experience: What BEC Defense Looks Like in the Real World
The following composite experience reflects common patterns found across BEC investigations rather than one specific organization. Imagine a midsize company receiving a routine invoice from a long-standing equipment supplier. The email arrives inside an authentic conversation that began months earlier. Names, signatures, purchase-order numbers, and quoted messages are all correct. Only one detail has changed: the supplier now wants payment sent to a different bank.
The accounts-payable employee notices nothing unusual because changing bank details is not impossible. Companies switch banks. Departments reorganize. Finance teams migrate systems. The invoice amount is also comfortably below the threshold that requires a second executive’s approval. The payment is prepared, reviewed for arithmetic errors, and released. Everyone has followed the documented process, yet the process was designed to confirm the invoicenot the identity of the person changing its destination.
The fraud is discovered several days later when the real supplier asks why its invoice is overdue. By then, the stolen money has traveled through multiple accounts. The incident-response team learns that the supplier’s mailbox was compromised weeks earlier. The attacker silently monitored conversations, created a hidden forwarding rule, and waited for a suitable invoice. There was no suspicious attachment and no cartoonishly misspelled message. The criminal simply joined an existing workflow and changed one field.
The most valuable lesson from this scenario is that technical security and financial controls must meet in the middle. Email filters alone cannot reliably determine whether a legitimate supplier truly changed banks. Accounts-payable staff cannot inspect authentication logs or mailbox rules. A resilient process therefore requires both groups to contribute.
After the incident, the company introduces a callback procedure. Every new beneficiary or banking change must be confirmed by calling a previously verified contact. A second employee records the confirmation, and payments to newly changed accounts are delayed for one business day. Email administrators enable stronger MFA, restrict automatic forwarding, improve DMARC enforcement, and alert on suspicious sign-ins and mailbox-rule creation.
The company also revises its awareness program. Instead of showing employees another slide featuring a badly spelled lottery email, it runs simulations based on actual business routines. Payroll receives direct-deposit changes. Sales receives fake contract requests. Executives receive collaboration invitations. Accounts payable receives updated invoices. Employees practice using the reporting button and are praised for questioning unusual requests.
A few months later, an executive-impersonation message asks an assistant to purchase gift cards for a confidential customer event. The email is polished, appropriately brief, and arrives while the executive is traveling. Previously, the assistant might have complied. This time, the assistant checks the executive’s known phone number and learns that no request was made.
The security team does not celebrate because its software caught the attack; the software had allowed the message through. The organization succeeds because its technology, procedures, and culture create several opportunities to interrupt the scam. That is the practical reality of BEC prevention. There is rarely one perfect control. There is a sequence of small barriers, and the attacker must fail at only one of them.
Conclusion
The 37 percent surge in June 2025 shows that business email compromise remains an adaptable, high-volume threat. Credential phishing dominated observed activity, free webmail continued to provide convenient infrastructure, and attackers mixed modest requests with potentially devastating wire fraud. The decline in average wire-transfer value did not make the problem smaller; it demonstrated how criminals adjust their demands to fit ordinary business behavior.
Organizations cannot solve BEC with an email filter and an annual training video. Effective defense requires phishing-resistant authentication, strong email controls, behavioral monitoring, independent payment verification, multiple approvals, realistic exercises, and a rapid response plan. Most importantly, employees must have permission to slow down when a request involves money, credentials, confidential data, or a sudden change in routine.
BEC succeeds when trust moves faster than verification. The winning strategy is not to eliminate trust from business. It is to give trust a reliable brake pedal.
SEO Tags
Note: Statistics describe reported or observed datasets and may not represent every BEC attempt worldwide. Organizations should verify current guidance and figures before publication or policy use.
