Fortra’s latest BEC Global Insights Report reveals attackers are chasing bigger payouts through proven social engineering tactics, with gift cards dominating cash-out methods and free webmail powering nearly three-quarters of all attacks
Business email compromise (BEC) activity climbed sharply in June 2026, with Fortra Intelligence and Research Experts (FIRE) recording a 22 percent increase in overall attack volume compared to the prior month, according to the company’s latest BEC Global Insights Report.
The findings, drawn from hundreds of active defence engagements with BEC threat actors each month, point to a threat that remains stubbornly effective rather than dramatically evolving.
JT Newby, Principal Threat Research Lead at Fortra, said the spike aligns with familiar seasonal patterns. “The increase is consistent with seasonal trends we’ve observed in previous years. June often sees elevated BEC activity as organisations enter vacation periods, staffing changes, and end-of-quarter business processes, creating more opportunities for attackers to exploit lapses in verification,” he said. “While the volume has increased, it doesn’t necessarily indicate a fundamental shift in attacker behaviour.
“BEC remains a highly effective and persistent threat that continues to deliver strong returns for cybercriminals.”
Gift cards remained the most common cash-out method, accounting for 59.9 percent of all attacks, followed by advanced fee frauds at 22.4 percent and wire transfers at 10 percent. Apple Store gift cards were the most frequently requested at 53.6 percent of all gift card demands, ahead of Amazon at 32.1 percent.
The report’s most striking finding concerns the scale of financial demands. While wire transfer attacks declined seven percent month on month, the average amount requested per attack jumped 32 percent, rising from $54,138 in May to $71,295 in June. Two thirds of wire transfer requests fell between $10,000 and $50,000, while 14 percent exceeded $100,000.
Newby said the escalation reflects growing attacker confidence rather than new techniques. “Overall, we’re not seeing a significant change in the core tactics used by BEC actors, who continue to rely on proven social engineering techniques, impersonation, and urgency to manipulate victims,” he said. “The increase in average wire transfer requests likely reflects attackers becoming more confident in targeting larger transactions rather than a major evolution in methodology.
“Attackers are refining what already works instead of reinventing their approach.”
Infrastructure analysis revealed 72 percent of BEC attacks were sent from email addresses hosted on free webmail providers, up from 62 percent in May, with the remaining 28 percent originating from maliciously registered domains. FIRE also identified 32 cryptocurrency-related scams involving 28 unique Bitcoin wallets, with an average request of $1,902.69. Geographically, the United States accounted for 33 percent of attack sources, followed by Nigeria at 28 percent.
Newby urged organisations to look beyond surface-level signals when assessing email legitimacy. “Organisations should recognise that the sender’s email provider alone isn’t a reliable indicator of legitimacy. Instead, businesses should implement layered defences that combine technical controls with user awareness,” he said. “This includes enforcing MFA across all business accounts, deploying DMARC, SPF, and DKIM to strengthen email authentication, flagging messages from external or newly observed senders, and requiring secondary verification for financial requests or changes to payment information.”
Ongoing security awareness training remains equally critical, he added, so employees can identify impersonation attempts and verify unexpected requests through trusted communication channels. “Such layered controls significantly reduce the likelihood that a single phishing email will result in financial loss, even as attackers continue to refine their social engineering techniques.”
Source: Tahawul Tech