BEC, Fraud & Social Engineering

Business Email Compromise (BEC) is among the costliest categories in the threat economy, and it uses almost no malware. In the FBI's 2025 Internet Crime Report (covering calendar 2025, released Apr 2026), BEC was the #2 cause of reported losses in the United States at $3.046B across just 24,768 complaints — an average loss of more than $122,000 per incident — second only to investment fraud. Total reported cybercrime losses hit $20.877B, up 26% year-over-year. BEC differs structurally from ransomware: it does not break a system, it exploits a person's judgment. There is no encryption to recover from and no leak site to negotiate with — only a wire that left because someone trusted an email. The sections below cover how BEC makes money, why it is hard for traditional security tooling to stop, how AI is re-industrializing it, and what each shift signals for defensive M&A.

What BEC is: exploiting the org chart, not the network

Business Email Compromise is fraud that weaponizes legitimate-looking communication and authority rather than malicious code. The canonical play: an attacker compromises or convincingly spoofs an executive's, vendor's, or finance employee's email, then inserts themselves into a real business process — a pending invoice, a payroll change, a closing wire — and redirects the money to an account they control. Because the message is grammatically clean, contextually accurate, and arrives inside a thread the victim already trusts, it sails past the controls built to catch malware. The IC3 data underlines the point: 86% of BEC funds move via wire transfer or ACH, landing directly inside real treasury and accounts-payable workflows. There is no payload for an endpoint agent to detonate and no signature for a gateway to match. The "exploit" is the process — the gap between an instruction that looks authoritative and a control that should have verified it out-of-band.

The category spans a family of related social-engineering frauds that share this DNA:

Account takeover is the connective tissue back to the rest of the threat economy: the credentials that let an attacker send from a genuine mailbox are overwhelmingly sourced from the infostealer-and-IAB supply chain (15b). BEC is frequently the monetization layer on top of credential theft — the cash-out for a stolen login that never needed ransomware at all.

Why BEC is the hardest threat to stop with tooling

This is why BEC has been such a durable demand generator for a specific slice of the defensive market. The legacy secure email gateway (SEG) was built to strip malicious attachments and links — exactly the things BEC doesn't use. The category's defense therefore migrated toward behavioral analysis: models that learn the normal communication graph of an organization (who emails whom, about what, with what tone and cadence) and flag the anomaly of intent — a first-time payment instruction, a sudden urgency, a vendor's bank details changing. This is the architectural flip from gateway to API-based, AI-native email security (the "integrated cloud email security," or ICES, wave covered in 03j) — and it is precisely why Abnormal, Sublime, Material, and Microsoft's own Defender for Office 365 compete on behavioral signal rather than signature matching.

AI is re-industrializing the confidence economy

The most important 2025–2026 development is that generative AI has removed the two historical tells of social-engineering fraud — bad grammar and the impossibility of real-time impersonation. The IC3 2025 report logged over $30M in losses from BEC scams with a confirmed AI nexus, and that figure is a floor (it counts only cases where investigators could confirm AI involvement). Three AI-driven shifts matter for the defensive thesis:

• Flawless, localized lures at scale. LLMs eliminate the broken-English signal that once let humans and filters catch phishing, and they let a single operator run native-quality campaigns in dozens of languages — collapsing the cost of a convincing pretext toward zero.
• Voice and video deepfakes ("vishing"/deepfake-BEC). Real-time voice cloning and video avatars let attackers impersonate an executive on a call, defeating the "I'll just phone the CFO to confirm" control that used to be the backstop. The 2024 Arup case — ~$25M wired after a deepfake video conference — is the template the market is now defending against.
• Agentic reconnaissance and thread-hijacking. AI agents can scrape org charts, vendor relationships, and writing styles to craft contextually perfect insertions into live threads — industrializing the bespoke research that used to make high-value BEC labor-intensive.

The strategic read: AI is lowering the attacker's cost faster than it is raising the floor on the average victim's defenses, which is exactly the condition that produces a multi-year demand wave for the controls that don't rely on spotting a payload — behavioral email AI, deepfake/voice authentication, and identity verification of the human and the instruction.

How the money moves, and why recovery is possible

BEC's monetization runs through money mules and layered accounts before converting to crypto or cash (the laundering mechanics are detailed in 15e). The one structural weakness the defender has is time: because the money moves through the regulated banking system first, a fast-enough response can claw it back. The FBI's Recovery Asset Team and the "Financial Fraud Kill Chain" exist precisely to freeze fraudulent domestic wires before they're withdrawn — which is why BEC, uniquely among threat-economy categories, has a recovery sub-market (incident response, forensic accounting, bank-coordination services) layered on top of the prevention market. This dual structure — prevent the wire, and if it leaves, recover it — is why BEC supports both an email-security thesis and an IR/insurance thesis at once (04e, 24).

What BEC demand maps to

In August 2026 this migration turned concrete: Visa agreed to acquire the behavioral-biometrics fraud-intelligence firm BioCatch for $2.4 billion in cash (announced Aug 3 2026, from funds advised by Permira), placing a behavioral-and-device-signal fraud primitive inside a payments network rather than a standalone security vendor. BioCatch analyzes thousands of behavioral, device, and network signals — keystrokes, touch gestures, device handling — to separate legitimate users from fraudsters in real time, and reports ~1.8 billion protected devices across 350-plus banks. The deal echoes Mastercard–Recorded Future (~$2.65 billion, 2024): the card networks are integrating fraud and behavioral intelligence upstream of the transaction — the same "prevention value moving toward the payment rail" dynamic the bear case below anticipates — while also marking the behavioral-identity and verification primitives, rather than the legacy gateway, as the durable equity. See M&A Deals & Comps, Identity.

The same pattern surfaced on the workforce vector days later: Deel — an HR, payroll, and employer-of-record platform — agreed to acquire the Tel Aviv deepfake-detection and identity-verification firm Clarity for a media-reported ~$45–50 million (announced Aug 3 2026; closed Jul 31 2026), forming Deel's first dedicated cybersecurity division. The rationale is the "fake hire" problem — AI-generated faces, voices, and credentials passing video interviews and onboarding — with Clarity's verification extending from pre-hire screening into ongoing workforce access. As with Visa–BioCatch, the buyer sits outside the security-vendor category, integrating a deepfake/identity primitive into its own workflow rather than buying it as a standalone product: a second August data point that the prevention value in AI-era fraud is migrating toward the platform that owns the transaction or the identity, and that early verification and deepfake-detection primitives are the durable equity ahead of category consolidation.

Falsifiable bear case

The "BEC guarantees durable email/identity demand" thesis has real failure modes. (1) The control may move out of security and into the bank/payment rail. If out-of-band payment verification becomes a native feature of treasury and AP software (ERP-embedded confirmation of payee/bank-detail changes), the prevention value migrates from a security vendor to the financial-workflow vendor — repricing the email-security premium. (2) Behavioral email security may commoditize into the Microsoft bundle. As Defender for Office 365's behavioral capabilities improve inside the E5 SKU, the standalone ICES premium compresses — the same bundling threat that hangs over the whole email category (03j). (3) AI cuts both ways on the demand curve. If defender-side AI (behavioral graphs, real-time deepfake detection) compounds faster than attacker-side generation, the average attack ROI deteriorates and the growth rate of BEC losses flattens — softening the urgency premium. The bear case isn't "BEC ends"; it's "the value of preventing it migrates from a security line item toward the payment rail and the platform bundle" — which is why the durable equity is in the behavioral-identity and verification primitives, not the legacy gateway.

/ angle

→ BEC is the cleanest argument for the email-security re-platforming thesis. The IC3 loss curve is a public, dated, annually-refreshed demand signal pointing straight at behavioral email security and identity. For a buy-side mandate, the screen is: who owns the behavioral graph and the identity-of-the-instruction, not who owns the gateway. That framing separates the structural winners (03j, 03a) from the legacy assets being absorbed.

→ Deepfake/voice authentication is a fundable white space. The confirmed-AI-nexus loss line is small today but growing off a near-zero base — the classic pre-consolidation entry point. Early-stage verification and deepfake-detection primitives are origination targets before the platforms buy the category (the same pattern as AI-security in 03l).

Sources: FBI — 2025 Internet Crime Report (IC3, released Apr 2026) · FBI press release — annual internet crime report · SpyCloud — IC3 2025: $20.9B in losses · Abnormal AI — what the 2025 IC3 report reveals about AI cybercrime · Red Sift — IC3 2025: email fraud is a $4B problem · The Record — cyber fraud surges, FBI IC3

Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.