The FBI warned businesses after a $129 million fake-CEO scheme in which the caller was not the only impostor.
The Bottom Line
AI has removed the trade-off between volume and precision that once limited impersonation attacks. Attackers now generate unique, well-researched messages that match a target’s tone and writing style, eliminating the awkward phrasing and generic greetings that used to flag a fake.
By the Numbers
National BEC incidents increased by roughly 20 percent compared to the 2020-24 average, while reported losses from cybercrime were 74 percent higher in 2025 than in 2020. Microsoft detected approximately 129 million malicious messages spoofing business service sender domains in the third quarter of 2026 alone. Credential theft remained the dominant objective in malicious attachment activity during the quarter.
How AI Removes the Tells
Generative models draft flawless executive emails in seconds, matched to a target’s language and tone. Attackers no longer need a single template for a thousand targets; they produce a unique message for every single one. A compromised supplier account can now send a message an AI model wrote to match twelve months of prior correspondence. The old signals — translation errors, odd phrasing, impersonal greetings — are gone.
The Exception That Swallows the Rule
Many spoofed emails reach inboxes because organization-configured exceptions overrode security protections, even after messages failed authentication checks and were identified as malicious. Overly broad exceptions intended to preserve legitimate workflows expose organizations to impersonation. In Microsoft Teams, attackers increasingly use ordinary personal names rather than explicit help desk identities while continuing live interactions for social engineering.
Technical Mechanics: SMTP’s Missing Lock
The original email protocols lack built-in authentication methods, enabling spoofing. When an SMTP email is sent, the MAIL FROM address and the visible From header are not checked by default to verify the sending system is authorized to send on behalf of that address. An attacker sets the header From to a trusted address while sending from an unrelated server; no mailbox is compromised and no password is stolen. SPF, DKIM, and DMARC exist to close this gap, but enforcement remains inconsistent because organizations fear blocking legitimate mail from marketing platforms, CRMs, or partner systems.
From Mass Phishing to High-Value Targets
BEC scammers impersonate trusted leaders and may hack real company accounts to increase credibility. Unlike mass phishing that casts a wide net, these attackers do their homework. The figure that matters is the shift to personalized, high-value targets: a finance manager receives an email from a supplier’s real inbox, using the supplier’s real writing style, referencing a real invoice number, asking to update payment details. Nothing about it looks wrong.
Sources
- Email spoofing
- Email threat landscape: Q3 2026 trends and insights | Microsoft Security Blog
- Missouri businesses lose $47.6M to cybercrime in 2025 | Fulton Sun
- Proton Business Email Arizona: 5 Security Wins [2026]
- What Is Email Spoofing and How Can You Prevent It?
- AI Has Changed the Math on Impersonation. | Proofpoint US
Photo: Raysonho @ Open Grid Scheduler / Scalable Grid Engine (CC0)
