99% of User-Related Threats Are Email Impersonation Attempts

According to recent reports, a staggering 25% of all corporate emails are deemed untrustworthy or malicious. Shockingly, 99% of these threats were email impersonation attacks such as BEC and credential theft lures that lack attachments or URLs that deliver malware payloads. Cybercriminals are now able to reach end-users by impersonating individuals, suppliers, and trusted brands, making it difficult for traditional email security tools to detect.

In the 2023 BEC Trends, Targets, and Changes in Techniques report, data from Fortra’s Agari and PhishLabs email security solutions illuminates current attack techniques and infrastructure used in email impersonation threats. Key findings include statistics on email sender spoofing classifications and volume, free webmail providers used in BEC attacks, and the growth of hybrid vishing attacks.   

While the fundamentals of BEC attacks have largely remained the same, criminals continue to optimize tactics to increase their success rate. Third-party targeting, AI, and phishing-as-a-service (PhaaS) have enhanced what was already working, putting the pressure on security teams to identify and mitigate social engineering threats before employees fall victim.  

Gain the email impersonation insights to understand the solutions needed to recognize patterns and make predictions to accurately detect signatureless threats at scale. Here you can access the full text of the report.