Floor dark green 1 FINAL

BEC Attacks Increase by Astounding 84%, New Research Shows

Business email compromise (BEC) attacks have increased considerably over the past 6 months. Here’s how cybercriminals are changing their targets and tactics.

April 7, 2022

Business email compromise (BEC) attacks may account for only a small percentage of all advanced attacks. Yet the fact that these attacks focus on tricking people instead of hardware and can circumvent traditional email security solutions makes them particularly concerning.

As we discussed in our H1 2022 Email Threat Report, advanced email attacks like business email compromise have seen considerable growth over the past six months. In addition, our data shows that cybercriminals have begun shifting their strategies to improve their chances of success.

Significant Increase in Business Email Compromise Attacks

In a BEC attack, the threat actor impersonates an employee or other trusted partner and convinces the victim to engage in an action such as providing access to sensitive data or transferring money. Despite greater awareness of business email compromise, threat actors continue to achieve their goals.

Between the first and second halves of 2021, there was an astounding 84% increase in the number of these attacks targeting Abnormal customers. Because these attacks are highly targeted and require significant research on behalf of the threat actor, they are relatively uncommon with an average of only 0.44 attacks per 1,000 mailboxes in the first half of the year. That said, the number of attacks climbed to 0.82 per thousand mailboxes in the second half of 2021.

Median Weekly BEC Attacks per 1000 Mailboxes

It’s also important to remember volume does not equal value when it comes to business email compromise. A single successful attack could have significant long-term financial or reputational consequences for an organization. In fact, according to the FBI Internet Crime Complaint Center (IC3), BEC attacks caused nearly $2.4 billion in losses in 2021 alone.

Small Businesses Receive Most BEC Attacks per Mailboxes

Because BEC attacks are highly targeted, their frequency doesn’t necessarily grow alongside the size of the organization the way more broad-based attacks do. Instead, because the number of attacks appears to decrease as the organization gets larger, it indicates the attackers are targeting specific roles—often members of the executive team and those in the finance department.

Between July and December 2021, organizations with fewer than 5,000 employees received the most attacks, with those between 1,000 and 1,500 employees receiving 1.59 attacks per 1,000 mailboxes each week. In contrast, organizations with more than 50,000 employees received only 0.13 BEC attacks per 1,000 mailboxes each week—further demonstrating that cybercriminals target specific roles.

Number of BEC Attacks per 1000 Mailboxes by Org Size

Nevertheless, due to the sheer volume of mailboxes, organizations with more employees have a higher probability of receiving at least one attack each week, with the largest organizations peaking at a 95% chance of attack.

Average Weekly Probability of Receiving a BEC Attack by Org Size

VIPs Impersonated Less but Attacked More

It’s common to see executives and other important names impersonated in business email compromise attacks. This is because threat actors rely heavily on name recognition to convince the target to complete the request. However, as more end users become aware of this tactic, threat actors seem to be shifting their strategy.

In the second half of 2021, executives were targeted less frequently as a percentage of all attacks, continuing a downward trend that started in the first half of the year.

Attacked Parties as Percentage of BEC Attacks

And while VIPs are still one of the most commonly impersonated parties in BEC attacks, they lost the top spot to impersonations of general employees in H2 2021. This could be a sign of cybercriminals choosing to engage in less obvious impersonation tactics to trick unsuspecting victims.

Interestingly, we noted a 23.9% increase in executive targeting between the first and last quarters of the year—indicating a transition in strategy from impersonating VIPs to targeting them. What did stay consistent is that in attacks targeting members of the executive team, the most common party impersonated is actually other executives, such as the CFO being impersonated in an email to the CEO.

Expect More Attacks in 2022

Cybercrime is an evolving game. As organizations and employees become more aware of one tactic, threat actors will adjust their strategies in an effort to stay one step ahead of email security platforms and security awareness training. The changes noted in this research are just some of the indicators that those shifts are already occurring, and organizations should expect to see more in the future.

To learn more about BEC attacks, as well as see additional data on supply chain compromise and phone fraud, download the email threat report.


Prevent the Attacks That Matter Most

Get the Latest Email Security Insights

Subscribe to our newsletter to receive updates on the latest attacks and new trends in the email threat landscape.

Demo 2x 1

See the Abnormal Solution to the Email Security Problem

Protect your organization from the attacks that matter most with Abnormal Integrated Cloud Email Security.

Related Posts

B 05 11 22 Scaling Out Redis
As we’ve scaled our customer base, the size of our datasets has also grown. With our rapid expansion, we were on track to hit the data storage limit of our Redis server in two months, so we needed to figure out a way to scale beyond this—and fast!
Read More
B 05 17 22 Impersonation Attack
See how threat actors used a single mailbox compromise and spoofed domains to subtly impersonate individuals and businesses to coerce victims to pay fraudulent vendor invoices.
Read More
B 05 14 22 Best Workplace
We are over the moon to announce Abnormal has been named one of Inc. Magazine's Best Workplaces of 2022! Learn more about our commitment to our workforce.
Read More
B 05 13 22 Spring Product Release
This quarter, the team at Abnormal launched new features to improve lateral attack detection, role-based access control (RBAC), and explainable AI. Take a deep dive into all of the latest product enhancements.
Read More
B 05 11 22 Champion Finalist
Abnormal has been selected as a Security Customer Champion finalist in the Microsoft Security Excellence Awards! Here’s a look at why.
Read More
Blog series c cover
When we raised our Series B funding 18 months ago, I promised our customers greater value, more capabilities, and better customer support. We’ve delivered on each of those promises and as we receive an even larger investment, I’m excited about how we can continue to further deliver on each of them.
Read More
B 05 09 22 Partner Community
It’s an honor to be named one of CRN’s 2022 Women of the Channel. Here’s why I appreciate the award and what I love about being a Channel Account Manager at Abnormal.
Read More
B 05 05 22 Fast Facts
Watch this short video to learn current trends and key issues in cloud email security, including how to protect your organization against modern threats.
Read More
B 05 03 22
Like all threats in the cyber threat landscape, ransomware will continue to evolve over time. This post builds on our prior research and looks at the changes we observed in the ransomware threat landscape in the first quarter of 2022.
Read More
B 04 28 22 8 Key Differences
At Abnormal, we pride ourselves on our excellent machine learning engineering team. Here are some patterns we use to distinguish between effective and ineffective ML engineers.
Read More
B 04 26 22 Webinar Re Replacing Your SEG
Learn how Microsoft 365 and Abnormal work together to provide comprehensive defense-in-depth protection in part two of our webinar recap.
Read More
Blog mitigate threats cover
Learn about the most common socially-engineered attacks and why these tactics are still so successful—despite a growing awareness from employees.
Read More