Table of Contents
Executive Summary
The BEC Global Insights Report presents a comprehensive analysis of the current cybersecurity landscape. Our research team, led by FIRE (Fortra Intelligence Research Experts), has been monitoring the trend of Business Email Compromise (BEC) attacks, which have shown an upward trend in February 2025.
Our findings indicate that the volume of BEC attacks increased by 13% compared to January 2025, with a notable rise in gift card-related scams. Gift cards remained the dominant cash-out method, accounting for 32.2% of financial scams. Cryptocurrency scams also saw an increase, with 81 reported cases affecting 76 wallets, including a significant loss of $4,428.77 USD.
In terms of attack vectors, the average requested wire transfer increased to $39,315, with major US banks targeted in 23% of cases. This highlights a preference for institutions with weaker fraud detection. The use of non-corporate email accounts continues to undermine authentication security, with 73% of BEC attacks originating from free webmail providers. Vishing scams also emerged, utilizing 11 fraudulent phone numbers linked to 5 brands.
Here are the key findings:
BEC attack volume increased by 13% in February 2025 compared to January 2025.
Gift cards accounted for 32.2% of all attacks, with gift card fraud remaining a dominant cash-out method (45.5% of financial scams).
Cryptocurrency scams involved 81 reported cases, affecting 76 wallets, including a wallet that collected $4,428.77 USD from victims.
The average requested wire transfer increased to $39,315 in February 2025, with major US banks targeted in 23% of cases.
73% of BEC attacks originated from free webmail providers.
Vishing scams utilized 11 fraudulent phone numbers linked to 5 brands, blending voice-based social engineering with email fraud.
The majority of BEC attacks came from Nigeria (52%), followed by the United States (30%), reinforcing the continued dominance of known cybercrime hubs.
Threat actors have intensified reconnaissance and profiling efforts, prioritizing larger financial targets and leveraging delayed fraud detection to increase operational success.
BEC Attack Trends
During the month of February 2025, FIRE observed a decrease of 13% in overall attack volume in comparison to the prior month.
Gift cards were the most common cash out method (32.2%), followed by advanced fee frauds (25.1%), payroll diversions (9.4%), credential phishing (5.9%), cryptocurrency (4.8%), wire transfers (1.8%), and vishing (0.8%). Twenty percent of the attacks in February 2025 requested various other types of payments.
BEC Wire Transfers
Wire transfer BEC attacks decreased by 19% in February (see Figure 2).
The average amount requested from BEC wire transfer attackers was $39,315 in February compared to $24,586 in January 2025, an increase of 60%. During the month of February, 25% of wire transfer BEC attacks requested less than $10,000, while 62% of wire transfer BEC attacks requested between $10,000 and $50,000. For the other 12% of wire transfer BEC attacks, 0% requested between $50,000 and $100,000 and 12% requested more than $100,000.
During the month of February 2025, major US banks proved to be the most common institutions of choice for wire transfer scammers, comprising 23% of the total. This type of bank was followed by specialty banks (23%), international (non-US) banks (23%), and regional US banks (17%).
BEC Payroll Diversions
During the month of February 2025, specialty banks proved to be the most common institutions of choice for payroll diversion scammers, comprising 38% of the total. This type of bank was followed by regional US banks (23%), online banks (15%), major US banks (11%), and credit unions (9%).
BEC Infrastructure
73% of BEC attacks were sent from email addresses hosted on free webmail providers compared to 27% of attacks sent from maliciously registered domains. The percentage of free webmail providers used decreased in February compared to 72% in January 2025.
For February 2025, Google was the primary webmail provider used by actors to send BEC campaigns, comprising of 76% of the 1,036 free webmail accounts used by scammers. Other popular webmail providers included Microsoft and Verizon Media.
BEC Attack Locations
Nigeria was the primary location¹ linked to BEC threat actors in February, with nearly 52% of all BEC actors originating from Nigeria-based IP addresses. United States was next, with 30% of the total attackers located there.
¹ Attacker locations are identified IP addresses collected by beacons that are inserted into our communications with BEC actors. IP addresses that are overtly associated with VPNs or other proxies are removed from this dataset; however, there is still a possibility that a device associated with an IP address could be used as a proxy in other ways, so the location (particularly for those outside West Africa) cannot be deemed completely definitive.
