Why business email compromise remains a critical financial institution risk

According to the FBI’s Internet Crime Complaint Center's 2025 Annual Report, reported cyber-enabled crime losses exceeded $20.8 billion, a 26% increase over the prior year. Business email compromise (BEC) alone accounted for more than $3 billion in reported losses, making it one of the largest sources of financial loss identified by the FBI. While organizations continue to invest heavily in cybersecurity technologies, many of today's largest fraud events do not begin with a technical compromise. Instead, they begin when a trusted employee, executive, vendor, or customer acts on a fraudulent instruction that appears legitimate. The attack surface is increasingly human rather than technological.

Social engineering fraud (SEF) and BEC schemes exploit employee’s trust, urgency and routine business processes to influence decision making and redirect funds. As threat actors leverage increasingly sophisticated tactics, including artificial intelligence (AI) generated communications, voice cloning and executive impersonation, the challenge for organizations is no longer solely preventing unauthorized access to systems. The FBI received nearly 25,000 BEC complaints in 2025, resulting in more than $3 billion in reported losses, reinforcing BEC's position as one of the most financially damaging forms of social engineering fraud.

Financial institution bonds (FIB) SEF claims scenarios

Willis’ claims data highlights that social engineering remains one of the most significant drivers of financial crime losses across the financial services sector. While customer impersonation accounts for approximately 35% of reported claims, it represents a disproportionate 59% of total loss costs, demonstrating the potential severity of a single successful attack. Customer account takeover and internal fraud impersonation schemes are also prominent loss drivers, collectively representing over 40% of reported incidents.

Importantly, Willis’ data suggests that the majority of losses stem not from sophisticated technical compromises, but from breakdowns in operational controls. Verification failures account for 41% of reported social engineering incidents, while failed controls and procedures not being followed account for a further 31%. These findings reinforce that strong governance; controls remain critical to mitigating fraud risk.

Willis’ global claims also demonstrate that social engineering is not isolated to a particular market or institution type. As fraudsters increasingly leverage AI-generated communications and multi-channel impersonation tactics, financial institutions should view social engineering as a strategic enterprise risk requiring ongoing investment in controls, oversight and employee vigilance.

The convergence of WTW’s internal crime data and Canadian insurer claims events suggests that, despite continued investment in security systems and controls, the primary drivers of loss remain breakdowns in employee scrutiny and verification processes. While SEF schemes often begin with relatively simple tactics, losses can escalate significantly when fundamental verification procedures are neglected or improperly applied.

This helps explain why SEF accounts for a disproportionately high share of total losses despite representing a smaller percentage of overall claim frequency. The findings indicate that the key distinction between a minor incident and a major financial loss is often the sophistication of the fraudster and the organization's response. Equally important is the effectiveness and consistent application of internal controls and verification protocols, which remain critical defenses against both BEC and SEF claim events. Willis’ data also shows the largest types of SEF losses are rooted in impersonation, underscoring the need for a rigorous application of internal controls and verification protocols.

• Impersonation of customer losses often involve fraudulent payment instructions sent by email from fraudsters purporting to be the client.
• Impersonation of supplier/vendor losses often involves a fraudster pretending to be a vendor/supplier of an insured and requesting a change in bank account details.

What this means for financial institution executives

The FBI data reinforces that social engineering fraud is no longer simply a cybersecurity issue, it is a financial risk, operational risk and governance issue.

For financial institutions, the implications are significant:

• Payment authority has become a critical fraud exposure: Many of the largest losses occur when legitimate employees authorize fraudulent transactions based on manipulated instructions.
• AI is reducing the effectiveness of traditional verification methods: Organizations can no longer assume that an email, voice call or virtual meeting participant is who they appear to be.
• Human controls are becoming as important as technical controls: Segregation of duties, independent payment verification and escalation procedures remain among the most effective defenses.
• Insurance structures should be reviewed holistically: Financial institution bond, cyber, social engineering fraud and funds transfer fraud coverages should be assessed together to identify potential gaps in protection.
• Employee awareness represents frontline control: As fraudsters increasingly target trust rather than technology, staff training and fraud awareness programs are becoming a core component of enterprise risk management.

As social engineering tactics become more sophisticated and AI further blurs the line between genuine and fraudulent communications, financial institutions should view fraud prevention as a strategic risk management priority. In an environment where trust is both a competitive advantage and a target, proactive investment in people, processes and technology is essential to strengthening resilience against evolving fraud threats.