Table of Contents
Executive Summary
The findings in this report come from the results of active defense engagements with BEC threat actors. Every month, the Fortra Intelligence and Research Experts team conducts hundreds of these engagements to collect comprehensive intelligence about BEC tactics and trends to help better understand how the BEC threat landscape is evolving.
The primary findings for January 2025 detailed in this report include the following:
During January 2025, the Fortra Intelligence and Research Experts team observed an increase of 10% in overall attack volume in comparison to the prior month.
Gift card were the most common cash out method in January, totaling 31.2% of all cash out methods.
The Fortra Intelligence and Research Experts team identified 158 cryptocurrency-related scams and recorded 122 unique wallets used by scammers.
During January, the Fortra Intelligence and Research Experts team collected 23 unique phone numbers and identified 4 distinct brands involved in vishing scams.
The average amount requested from BEC wire transfer attackers was $24,586 in January compared to $16,799 in December 2024.
During the month of January 2025, international (non-US) banks proved to be the most common institutions of choice for wire transfer scammers, making up 30% of the total.
During the month of January 2025, specialty banks were the most common institutions of choice for payroll diversion scammers, totaling to 46%.
72% of BEC attacks were sent from email addresses hosted on free webmail providers compared to 28% of attacks sent from maliciously registered domains.
For January 2025, Google was the primary webmail provider used by actors to send BEC campaigns, comprising 73% of the 1,177 free webmail accounts used by scammers.
Nigeria was the primary location linked to BEC threat actors in January, with 43% of all BEC actors originating from Nigeria-based IP addresses.
BEC Attack Trends
During the month of January 2025, the Fortra Intelligence and Research Experts team observed an increase of 10% in overall attack volume in comparison to the prior month.
Gift cards were the most common cash out method (31.2%), followed by advance fee fraud (20.7%), payroll diversion (8.3%), cryptocurrency (8.3%), credential phishing (6.4%), wire transfer (1.9%), and vishing (1.3%). Twenty-one percent of the attacks in January 2025 requested various alternative forms of payments.
BEC Wire Transfers
Wire transfer BEC attacks increased by 61% in January (see Figure 2).
The average amount requested from BEC wire transfer attackers was $24,586 in January compared to $16,799 in December 2024, an increase of 46%. During the month of January, 30% of wire transfer BEC attacks requested less than $10,000, while 64% of wire transfer BEC attacks requested between $10,000 and $50,000. For the other 6% of wire transfer BEC attacks, 6% requested between $50,000 and $100,000 and 0% requested more than $100,000.
During the month of January 2025, international (non-US) banks proved to be the most common institutions of choice for wire transfer scammers, comprising 30% of the total. This type of bank was followed by major US banks (27%), regional US banks (16%), and specialty banks (14%).
BEC Payroll Diversions
During the month of January 2025, specialty banks proved to be the most common institutions of choice for payroll diversion scammers, comprising 46% of the total. This type of bank was followed by major US banks (17%), regional US banks (13%), credit unions (9%), and online banks (9%).
BEC Infrastructure
72% of BEC attacks were sent from email addresses hosted on free webmail providers compared to 28% of attacks sent from maliciously registered domains. The percentage of free webmail providers used increased in January compared to 67% in December 2024.
For January 2025, Google was the primary webmail provider used by actors to send BEC campaigns, comprising of 73% of the 1,177 free webmail accounts used by scammers. Other popular webmail providers included Microsoft and Comcast.
BEC Attack Locations
Nigeria was the primary location¹ linked to BEC threat actors in January, with nearly 43% of all BEC actors originating from Nigeria-based IP addresses. United States was next, with 38% of the total attackers located there.
¹ Attacker locations are identified IP addresses collected by beacons that are inserted into our communications with BEC actors. IP addresses that are overtly associated with VPNs or other proxies are removed from this dataset; however, there is still a possibility that a device associated with an IP address could be used as a proxy in other ways, so the location (particularly for those outside West Africa) cannot be deemed completely definitive.
Cybercrime Intelligence Shouldn't Be Siloed
Fortra® experts are dedicated to protecting organizations and the public by delivering the latest insights, data, and defenses to strengthen security against emerging cyber threats.
