Scamming 101

There’s uptime. There’s downtime.

Welcome to the School of Hard Times (in 3 parts).

Where you go so you don’t suffer a $38,000 Wednesday afternoon

The pandemic years brought spikes and since then the Business Email Compromise (BEC) scamming technique has not abated: financial losses, per the FBI, are almost all more and more.

Not that it was ever what you’d call good news, but it was reported last year that the FBI observed a plateau in Business Email Compromise (BEC) cases. But the report issued this year (about 2025) reveals the continued upward trend: the FBI has a 7 percent rise from 2024 to 2025 in the amount of money stolen by scammers from businesses. This equates to a $3 billion loss for American businesspeople, and most of these funds are leaving US shores where, as you may imagine, there’s very little prosecutorial recourse once in overseas-controlled wallets.¹

Smaller organizations are the targets that don’t make the news

Like everything else in the media and on the internet, for that matter, the big players are the ones that get talked about, the big scams, the big mistakes, the big falls, but the data show a different reality. Big businesses, while the biggest targets are also the most prepared to face an attack, leaving smaller organizations the easier bread-and-butter pickings for criminals. I haven’t found exact numbers on the share of the $3B that was paid by smaller organizations, but Verizon examined 69,000 cyberinsurance claims and shows BEC responsible for 19% of losses and the median loss per claim for small business exceeding $38,000.²

BEC is a human, relational scam

A BEC scam is when an attacker impersonates a vendor, employee, someone known and trusted – especially one’s own executives and board members – with the purpose of defrauding the organization, its employees and/or stakeholders into sending money or revealing sensitive data.

There are many variations, but in a typical BEC attack, criminals send an email message in the name of a known source making a somewhat plausible request. For example a vendor seems to ask for your credit card information or a bank looks like it’s giving updated instructions on how to wire your payment.

In a prominent example, deepfake audio was used to trick a British CEO into believing his German boss had requested a €220,000 money transfer. In another, a bank manager from the UAE was conned into transferring $35 million at the request of a ‘customer’ … One attempt tried to trick a victim organization into transferring $36 million in funds.³

BEC attacks prey on our sense of urgency, just being hurried and not always as careful as we should be and our expectations: on a personal level you’ll see this vein of scam attack when you open a new account and immediately get a docusign email from what turns out to be an illegitimate source.

These are just twistings of everyday interactions into something dangerous. In part 2 we’ll look at attacks that while they are sometimes launched by a human click, are built to exploit computer infrastructure itself.

<sup>1 https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf

2 The Verizon DBIR shows the 19% and the insurance study is here: https://www.verizon.com/business/resources/reports/2026-breach-impact-study-dbir.pdf</sup>

^{3 https://blog.barracuda.com/2023/04/11/new-wave-bec-attacks}