Why Business Email Compromise Is Increasing in Cyber Claims
Business email compromise is becoming one of the most common ways cyber incidents unfold today.
In 2025 alone, it accounted for 31% of all cyber claims. What makes it different is that it does not rely on breaking into systems in the traditional sense. Rather, it works through everyday communication.
What’s Driving the Increase
The rise comes down to how simple and effective these attacks are.
Instead of deploying malware, attackers gain access to an email account and invest their time in understanding how businesses operate. They observe conversations, payment processes, and internal workflows before making a move.
Because everything happens within a trusted channel, nothing immediately feels out of place.
It Doesn’t Stay Contained
In most cases, an email breach is just the beginning. Once the attackers have access, they often move toward financial fraud. As per reports, about 52% of fraud-related incidents begin here, with payment details being altered or transactions being redirected.
By the time something feels off, the damage is already in motion.
Why It Works So Well
The reason these attacks work so well is that they are built around people, rather than systems. The financial requests are always designed to look familiar, regardless of who they come from. They also include a sense of urgency, which pushes the reader towards quick decisions rather than verification.
Nothing about it looks like a typical cyberattack, and that is exactly why it works.
More Frequent, Better Managed
In 2025, the number of incidents increased by 15%. At the same time, the average loss per claim dropped to around $27,000. This suggests that while attacks are happening more often, businesses are getting better at responding and limiting the impact.
Why It Still Matters
Even with smaller average losses, the broader risk remains.
These incidents are often the starting point for larger issues, which could be financial loss, operational disruption, or data exposure. While the initial access may seem small, it rarely stays that way.
What Businesses Should Focus On
Preventing such a risk is more about the process, rather than the tools.
- Double-checking payment requests
- Paying attention to unusual communication patterns
- Creating clear internal verification steps
Conclusion
Cyber risk and attacker strategies are both changing. Instead of forcing themselves in, they are working within systems that already exist. Understanding that shift is key to staying ahead and reducing exposure.
