Business email compromise used to follow a predictable script: a fraudster, hours of manual research, a carefully worded impersonation email, and a wire transfer request. Security teams learned the playbook. They trained employees to spot the red flags. For a while, that worked.
It doesn't work anymore.
The threat has fundamentally mutated. AI agents — autonomous software systems capable of researching, writing, personalising, and delivering communications without human intervention — have turned BEC from a cottage industry into an industrial operation. The numbers are alarming, the attack surface is expanding, and most organisations are still defending against the old version of the threat.
Here's what's actually happening, why it matters, and what you can do about it today.
The Scale of the BEC Problem Has Reached a Tipping Point
Before diving into AI agents specifically, it's worth grounding the conversation in hard data.
The FBI's 2025 IC3 Annual Report recorded $3.046 billion in BEC losses across 24,768 complaints, making BEC the second-highest loss-generating cybercrime in the United States behind only investment fraud.
And that figure dramatically understates the true damage.
Industry estimates consistently suggest that only 15 to 20% of BEC losses are ever reported to law enforcement.
The velocity of growth is just as striking.
Since the popularisation of generative AI tools, there has been a 1,760% year-over-year increase in BEC attacks — what used to account for 1% of all cyberattacks in 2022 now represents 18.6% of all attacks.
This isn't a gradual escalation. This is a step change, driven almost entirely by AI.
How AI Has Transformed the BEC Attack Lifecycle
Traditional BEC required skill, time, and patience. An attacker needed to understand their target, craft believable prose, and time their approach carefully. AI has automated every one of those steps.
AI compresses reconnaissance, content creation, and delivery into a single automated workflow. Attackers use AI to scrape public data from LinkedIn profiles, company websites, and social media platforms, then generate personalised lures based on that intelligence.
AI slashes phishing development from 16 hours to 5 minutes, erasing the detection window defenders once used to identify and respond to threats.
The quality of the output is no longer a giveaway either.
Cyberattackers now produce grammatically flawless, individually personalised lures at machine speed — and those messages arrive from properly authenticated domains carrying no malicious payload at all.
There's no link to scan, no attachment to sandbox, and no broken English to flag.
The results speak for themselves.
Research shows that 60% of recipients fall for AI-generated phishing emails, with click-through rates reaching 54% compared to just 12% for traditional phishing.
The Rise of Vendor Email Compromise and Thread-Aware Attacks
One of the most important — and underreported — shifts is who attackers are now impersonating.
Vendor email compromise (VEC) now accounts for the majority of BEC attacks, making up 61% of all BEC
, based on analysis of nearly 800,000 email attacks across 4,600+ organisations.
As attackers shift toward impersonating trusted vendors, they are increasingly using high-stakes financial workflows to maximise impact.
This matters because vendor emails sit in a trust grey zone. Your employees expect invoices, payment updates, and remittances from external partners. There's no internal alarm bell when the sender appears to be a familiar name.
AI ingests entire stolen mailbox histories, learns normal payment flows and approval language, then joins existing email threads at the right moment. This is not spoofing — this is impersonation that understands context.
The AI doesn't just know what to say; it knows when to say it.
AI Agents Are Now Targeting Other AI Agents
Here's where the threat landscape takes a genuinely new turn. As organisations deploy AI agents — tools like Microsoft 365 Copilot, AI-powered email assistants, and workflow automation bots — attackers aren't just targeting human employees anymore. They're targeting the AI systems themselves.
As organisations grant AI agents authority over business systems like payments and vendor data, attackers are shifting from socially engineering human employees to socially engineering AI agents via prompt injection.
Attackers embed malicious instructions inside content an AI agent processes — such as a résumé, email, or web page — exploiting the agent's difficulty distinguishing instructions from data. If the agent is authorised to take privileged actions like changing vendor banking details or approving payments, the attacker can redirect funds or exfiltrate data without ever needing to trick a human.
A real-world example illustrates the stakes.
Researchers disclosed CVE-2025-32711 ("EchoLeak"), the first documented instance of a prompt injection vulnerability in Microsoft 365 Copilot, where an attacker sending a single crafted email could cause Copilot to access files from OneDrive, SharePoint, and exfiltrate data.
Prompt injection is now the number-one security threat to AI systems in 2026, with a 340% year-over-year increase in attacks.
The Dark LLM Ecosystem: BEC as a Service
Fuelling all of this is a thriving underground economy.
Dark LLMs such as WormGPT, FraudGPT, and KawaiiGPT are built without safeguards and sold on Telegram and dark web forums to automate phishing, BEC, and malware.
These tools don't require hacking expertise.
Dark large language models and phishing-as-a-service subscriptions have decoupled cyberattack quality from operator skill, widening the pool of capable adversaries.
A criminal with minimal technical knowledge can now subscribe to a service that handles reconnaissance, email generation, delivery, and follow-up — essentially a BEC campaign manager in a subscription box.
One discovered phishing kit uses an AI pipeline to read harvested mailboxes and map an organisation's payment flows, invoices, and outstanding balances.
It's not just writing emails — it's understanding your business deeply enough to know exactly which wire transfer request will look legitimate.
The Deepfake Multiplier: When Email Isn't Enough
AI-powered BEC doesn't stop at text.
The proportion of BEC attacks leveraging AI-generated voice, video, or text deepfakes has reached 40% in 2026, up from under 5% in 2023.
Voice cloning attacks, particularly used for BEC, increased by 81% in 2025.
The attack chain is disturbingly accessible.
An attacker scrapes just three seconds of your CFO's audio from a quarterly earnings call or a LinkedIn video. A commodity voice cloning tool, available for under $20 on dark web markets, generates a synthetic voice replica.
Average per-incident losses from AI-augmented BEC now exceed $4.1 million, compared to $1.3 million for traditional phishing attacks.
The combination of a convincing email thread and a synthetic executive voice calling to "confirm" the transfer is proving devastatingly effective.
Practical Tips: What You Can Do Right Now
The threat is real and escalating — but it's not undefendable. Here are actionable steps your organisation can take immediately:
-
Implement out-of-band verification for all financial transactions. Any wire transfer, banking change, or payment authorisation should require a confirmed phone call to a pre-registered number — never a callback to a number provided in the suspicious email or message.
-
Audit your AI agent permissions.
Identity and access controls must extend to AI agents with the same rigour applied to human users, including token management and dynamic authorisation policies.
If your AI copilot can send emails or approve payments, that's an attack surface — treat it like one.
- Treat all external data entering your AI agents as potentially hostile.
Clearly separate system instructions from user content using structured formatting, and treat every document, email, web page, and database record that enters the context window as a potential attack vector.
- Require human-in-the-loop approval for high-risk agentic actions.
Security researchers recommend human-in-the-loop approval for high-risk actions
as a core safeguard against prompt injection attacks that target AI agents.
-
Run AI-aware phishing simulations. Your existing security awareness training was likely built for template-based attacks. Update your simulations to use AI-generated, contextually personalised scenarios to reflect what employees are actually facing.
-
Monitor for payment flow anomalies, not just malicious payloads.
BEC requires no malware — just convincing impersonation, now supercharged by AI-generated content.
Traditional endpoint detection won't catch it. Behavioural anomaly detection on financial workflows is essential.
- Inventory every AI tool and integration in your environment.
Third parties were involved in 48% of breaches — a 60% increase year over year — coinciding with organisations increasingly connecting AI applications to the platforms and APIs that run core business processes.
Know what's connected and what it's authorised to do.
Conclusion: The Threat Has Evolved — Has Your Defence?
AI agents have collapsed the cost, skill barrier, and time required to execute a sophisticated BEC attack. They've also created an entirely new attack surface: your own AI tools. The organisations that get ahead of this threat are not the ones waiting for their legacy email filters to catch up — they're the ones rebuilding their trust models, their authorisation frameworks, and their employee training from the ground up.
The question isn't whether your organisation will be targeted by AI-powered BEC. The question is whether your defences are as intelligent as the attacks being launched against you.
Is your email security strategy built for 2026 or 2016? Contact our team today for a no-obligation AI threat assessment and find out exactly where your organisation is exposed — before the attackers do.
