Spear Phishing: Top Threats and Trends Vol. 3 – Defending against business email compromise attacks

Key findings:

• Business email compromise (BEC) makes up only 7% of all spear-phishing attacks, but has caused more than $26 billion in losses in the last four years, according to the FBI.
• 91% of BEC attacks take place on weekdays. Attackers try to mimic business behavior as much as possible, often sending emails during the compromised account’s typical working hours to make them appear more convincing and trustworthy.
• Business email compromise attacks are low volume and highly targeted. The average attack targets no more than 6 employees.
• 85% of all business email compromise attacks are urgent requests that are designed to get a fast response. 59% ask for help, and 26% ask about availability.
• Business email compromise attacks have high click rates. 3 in 10 spearphishing emails successfully trick a user into clicking when the email impersonates the organization’s HR or IT department.
• The costs and damages associated with spear-phishing attacks are high. In the last 12 months, the average amount lost per organization due to spear-phishing attacks was $270,000. There are a wide range of financial impacts from attacks, including business interruption, reduced productivity, data loss, regulatory fines and brand damage.