The Inbox Is Still the Front Door

A hacker doesn't need to break your firewall. They need to send one convincing email.

That's the uncomfortable truth about Business Email Compromise, and it's why BEC keeps sitting near the top of the loss charts year after year while flashier threats grab the headlines. No malware. No zero-day. No smoking gun in your SIEM. Just a message that looks like it came from your CEO, your vendor, or your bookkeeper, asking you to move money or change where the money goes.

In 2025, the FBI's Internet Crime Complaint Center logged 24,768 BEC complaints totaling roughly $3.05 billion in reported losses (FBI IC3 2025 Annual Report). That's up about 16% in complaints and 10% in dollars over 2024. Zoom out and it's uglier: the IC3 has tied more than $55 billion in exposed losses to BEC between late 2013 and the end of 2023. This isn't a niche scam. It's one of the most expensive crimes on the internet, and it runs almost entirely on trust.

Why the old advice stopped working

For years we told people to watch for the tells. Bad grammar. Weird phrasing. A greeting that felt off. A sender address with one letter swapped. If it looked sloppy, it probably was.

That advice is now a liability.

Generative AI erased the tells. Large language models write clean, on-tone, contextually perfect emails in seconds, in any language. The attacker who used to give himself away with broken English now sounds exactly like your regional sales director because a model studied your public writing and matched the cadence. Free tools scrape LinkedIn, press releases, and org charts to build a dossier on your finance team in minutes. The reconnaissance that used to take a human days now takes a bot a coffee break.

Then it gets worse. Voice cloning needs only a few seconds of audio, and executives leave audio everywhere: podcasts, earnings calls, webinars, voicemail greetings. So the "just call them to confirm" step, the control we leaned on for a decade, now gets you a synthetic voice on the line telling you the wire is legit. Deepfake video has pushed this into live meetings, where a face on the call authorizes a transfer and nobody in the room realizes they're talking to a puppet.

The pattern to sit with: AI lowered the cost and raised the quality of these attacks at the same time.

When something gets cheaper and better at once, you get more of it. That's the curve we're on.

It's usually your vendor, not your CEO

The classic image of BEC is a fake email from the boss. That still happens, but it's not where most of the money leaks.

The bigger problem is vendor and invoice fraud. Abnormal Security has found that vendor email compromise accounts for roughly 61% of all BEC, and that employees engaged with 44% of the vendor-compromise attacks they actually read. The Association for Financial Professionals' 2026 survey tells the same story from the victim's side: about 74% of organizations were hit by BEC in 2025, wire transfers were the target in 63% of fraud attempts, and vendor imposters showed up in 45% of them.

Here's why that angle works so well. When "accounts payable" at a supplier you've worked with for three years emails to say their banking details changed, there's real history behind that thread. Sometimes the attacker has hijacked the actual conversation from a compromised mailbox, so they're replying inside a legitimate email chain you started. Nothing looks spoofed because nothing is spoofed. It's a real account, a real relationship, and a small edit to a routing number.

How you actually fight this

You can't out-inspect a machine that writes flawless email. Staring harder at the message is a losing game. The defense that holds up is a shift from judging content to enforcing process, and it comes down to a handful of things you can start on this quarter.

**Verify out of band, every time money or bank details move.** Not a reply to the email. Not the number in the email signature. A phone call to a contact you already had on file, dialed from your records. Bake this into policy so it isn't a judgment call under pressure. Any change to payment instructions triggers a call-back to a known-good number, no exceptions, no matter how urgent the request claims to be.

**Require two sets of eyes above a dollar threshold.** Dual authorization on wires and vendor banking changes means one compromised person can't complete a fraud alone. It's boring, and it works.

**Stop trusting a voice as proof.** If your verification step is a phone call, add a challenge that a deepfake can't answer: a shared detail only the real person would know, agreed on ahead of time. Voice confirmation by itself is no longer confirmation.

**Lock down your domain with DMARC at enforcement.** Publishing DMARC at p=reject stops criminals from spoofing your exact domain to hit your own staff and your customers. Plenty of companies deploy it in monitoring mode and never turn on enforcement, which is like installing a lock and leaving it unlatched.

**Use phishing-resistant MFA.** A lot of BEC starts with a stolen login, and text-message or app codes can be phished or fatigued out of people. Hardware security keys and passkeys shut that door in a way that six-digit codes can't.

One honest caveat: none of this makes you bulletproof. A determined crew with a good pretext and a rushed employee will still get through sometimes. The point isn't perfection. It's making your organization a slower, more expensive, more error-prone target than the next one, and building enough friction into the money-movement path that a single mistake doesn't become a single point of failure.

If it already happened, speed is everything

Move fast and you can claw money back. In 2025 the FBI's Financial Fraud Kill Chain worked 3,900 incidents involving $1.164 billion in attempted theft, froze $679 million of it, and hit a 58% success rate on recoveries (FBI IC3 2025 Annual Report). That success is almost entirely a function of hours. Call your bank the moment you suspect fraud, ask them to recall the wire, and report it to IC3 at ic3.gov immediately. Waiting until Monday is how a recoverable mistake becomes a permanent one.

The bottom line

BEC isn't a technology problem you can buy your way out of. It's a trust problem that technology has made cheaper to exploit. The attackers figured out that the softest target in your company isn't a server, it's the assumption that the email in front of you is who it says it is.

So stop trying to spot the fake. Assume any request to move money or change payment details could be one, and build the verification into the process instead of the person. The inbox is still the front door. Decide who you actually let in.

At CyberShell, this is the work we do for Canadian businesses every day. If you're not confident your email security would survive a modern BEC attempt, our email security assessment is built to answer exactly that. We look at your domain protection, MFA, and the payment-verification process your team actually follows under pressure, then we show you where the gaps are before someone else finds them. Have a look at what we do at cybershell.ca.

You cannot fully predict the incident that will test your organization. You can absolutely control the quality of the people, processes, and authority structures that respond to it. That preparation is the difference between organizations that recover in days and those that recover in quarters.