Newsletters
Risk Central
Digital EditionBusiness Email Compromise Claims Jump 30% as A.I. Reshapes Cyber Risk
Business email compromise claims rose roughly 30% in 2025 compared with the second half of 2024, according to briefing by Coalition, which found this surge driven largely by automated phishing kits that use artificial intelligence to bypass multi-factor authentication and scale attacks against small businesses previously considered too minor to target.
The cyber insurer, which draws on anonymized claims data from a portfolio of more than 110,000 global policyholders, said the pattern mirrors past cycles in which criminals needed years to find a profitable way to exploit new technology, from stolen-data forums in the 2000s to cryptocurrency-enabled ransomware in the 2010s. Coalition said it believes A.I. is following a similar trajectory, with impact varying sharply by claim type: Business email compromise (BEC) has already shifted, funds transfer fraud is poised to follow, and ransomware remains constrained by manual steps attackers still can’t automate.
BEC Automation Takes Hold
Coalition pointed to EvilTokens, a software-as-a-service phishing kit, as the clearest example of A.I. changing the cybercrime business model. The platform, which compromised more than 12,000 inboxes across over 10,000 organizations worldwide, uses A.I. to draft phishing emails, evade detection and parse inboxes for sensitive data, all for an initial cost of $1,500 and a $500 monthly subscription, according to the report.
Coalition said BEC frequency climbed 67% in 2020, but attributed that spike to pandemic-driven shifts to online work rather than the GPT-2 and GPT-3 models released around the same time, noting that OpenAI itself found GPT-4 was “not a ready-made upgrade to current social engineering capabilities” when it evaluated the model in 2023.
The more recent 30% rise beginning in late 2025, by contrast, coincided with the proliferation of agentic tools capable of executing an entire BEC attack end-to-end. Coalition forecasts the increase will exceed that figure as automated multifactor authentication-bypass tools spread further, though it does not expect frequency to rise beyond 100% because attackers remain bottlenecked by infrastructure takedowns and the logistics of organizing money mules to cash out stolen funds.
Average BEC losses remain under $30,000, the report said, though it noted that NetDiligence has documented a $30 million claim illustrating potential severity at the high end.
Funds Transfer Fraud and Ransomware Lag Behind
Funds transfer fraud frequency actually declined 18% in 2025 after holding steady at 0.51% of claims over the two prior years, Coalition found, and deepfake-driven instructions remain rare, with most fraudulent transfers still initiated by email. Coalition expects frequency to rise 20% to 50% over the next year as automated BEC tools are extended to identify pending payments and craft redirection emails, while deepfake-enabled fraud specifically is projected to grow 20% to 50% by 2027.
Ransomware claims frequency has shown no year-over-year change, the report said, even as Coalition’s threat intelligence team recorded roughly three times as many vulnerabilities suitable for ransomware exploitation in August and September 2026 compared with before the release of models by Project Glasswing, a defensive cybersecurity coalition launched by Anthropic.
Coalition attributed the lag to the manual, human-driven negotiation and network-compromise stages of ransomware, which it expects to remain largely unautomated for 12 to 36 months, with automation concentrating instead on low-value targets such as micro-businesses and public-facing web servers.
Deepfakes and Legal Abuse Widen the Risk
Beyond direct cyberattacks, Coalition flagged reputational deepfakes and A.I.-enabled legal abuse as expanding risks. Business-related deepfake incidents remain rare but are growing steadily, the report said, most often involving disgruntled ex-employees depicting executives making unsavory statements.
Separately, Coalition said a single self-represented plaintiff, Vivek Shah, filed more than 150 privacy claims against the insurer’s policyholders over the past year, doubling the frequency of privacy claims in the first half of 2026 before a California federal court declared him a vexatious litigant in July. Coalition said it cannot confirm A.I. involvement but called the scale “suggestive,” warning the tactic could spread to other liability lines, including employment practices litigation targeting non-compliant job postings.
Obtain the briefing here. &
