Wire transfer losses from Business Email Compromise (BEC) have soared by over 48% from the previous quarter to hit an average of more than $80,000, according to Agari.
The security vendor’s findings were revealed in the latest Phishing Activity Trends Report from the Anti Phishing Working Group (APWG).
Agari noted that BEC losses involved in bank transfer attacks jumped significantly from the $54,000 recorded in the first quarter, although these accounted for just 18% of total attacks.
Gift cards were the most popular way for scammers to monetize attacks, with BEC attackers requesting these in two-thirds (66%) of raids. Cards from eBay, Google Play, Apple iTunes, and Steam Wallet accounted for the vast majority (70%) of attacks.
However, gift card scams don’t net attackers much: the average amount requested by scammers dropped from $1,453 in the first quarter of 2020 to $1,213. Just 16% of BEC attacks were recorded as requesting “payroll diversions,” down from 25% in Q3 2019.
Despite the majority of attacks targeting users with fairly modest requests for money, some groups are continuing to push the boundaries.
One Russian cybercrime group known as Cosmic Lynx demands an average of nearly $1.3 million per BEC attack, according to Agari. As previously reported by Infosecurity, the group has been involved in over 200 BEC campaigns since July 2019, targeting executives in 46 countries.
Agari has in the past also warned of BEC gangs from West Africa operating highly sophisticated campaigns.
According to the FBI’s annual report, BEC continued to be the biggest money-maker for cyber-criminals last year, accounting for over half of all losses to cybercrime.
BEC scammers made almost $1.8 billion in 2019, over half the $3.5 billion total, according to the FBI’s 2019 Internet Crime Report. That’s up from around $1.3bn and a total of $2.7bn in 2018.