Email Is Still the Weakest Link

Financial fraud remains the leading driver of cyberinsurance claims, with 83% of cases traced back to email-based attacks. Common tactics used to deceive employees include wiring funds to fraudulent accounts, generative AI-crafted emails, executive and vendor impersonation and business email compromise scams.

See Also: New OnDemand | QR Codes Exposed: From Convenience to Cybersecurity Nightmare

The findings by At-Bay reflect broader fraud trends. According to the FBI’s latest Internet Crime Report, losses from BEC scams alone topped $2.9 billion in the U.S. in 2023. Similarly, a recent LexisNexis Risk Solutions report highlights that financial services institutions globally experienced a 61% increase in fraud attempts involving synthetic identities and mule accounts.

Financial fraud continues to lead the pack in cyberinsurance claims, with email emerging as the primary attack vector, especially for mid-sized businesses. The 2025 At-Bay InsurSec Report reveals that financial fraud made up nearly a third of all cyberincidents among its insured clients in 2024.

While email was the starting point in 43% of all cyberinsurance claims, it was used in just 6% of ransomware attacks. In contrast, 83% of financial fraud cases began with a fraudulent email. This shows that while email security tools are good at blocking malware, they often miss scam emails that trick people into sending money. Instead of trying to break into computers, cybercriminals are now focusing on fooling people through carefully crafted messages, the report said.

“A BEC scam is more of a human vulnerability than a technological or organizational one,” said Mario Demarillas, a member of the board of directors, CISO and head of IT consulting and software engineering at Exceture. “We humans are trained from childhood to adulthood to trust in the physical world implicitly. But we do not make an adequate transition in trust from the physical to the digital environment, so scams such as BEC thrive in the digital world,” he said.

While employee security awareness training is important – especially for finance and HR teams – implementing multifactor authentication across all accounts and using email authentication protocols such as DMARC, SPF and DKIM is now being made mandatory by cyberinsurance firms. In fact, cyberinsurers are now scrutinizing clients’ email security posture before underwriting policies, with some denying coverage if MFA and BEC simulation training are absent, found a study by Coalition’s Cyber Insurance Claims Report.

Across industry sectors, financial and insurance companies suffered the most significant average losses from financial fraud, at over $500,000 per incident. Other highly impacted sectors include construction, professional services and manufacturing.

These fraud trends underscore the vulnerability of multiple parts of an organization, as attackers increasingly exploit routine digital communication for high-stakes financial gain.

Meanwhile, countries are coming out with legal responses to BEC scams. In the U.K., the Payment Systems Regulator’s new mandatory reimbursement rule aims to curb losses from authorized scams, including BEC, which accounted for nearly £500 million in losses last year.

FS-ISAC also has introduced a Cyber Fraud Prevention Framework to help financial institutions streamline and strengthen their fraud prevention and mitigation efforts by breaking down silos between cyber and fraud teams. The framework encourages institutions to examine the earlier stages of the fraud lifecycle, such as reconnaissance and initial access, where behavioral anomalies or social engineering attempts might be detected.