The most expensive phishing email your company will receive has no virus and no strange link. It looks like a normal message from a supplier you know, saying their bank account has changed and asking you to pay the next invoice to the new IBAN. In the FBI's 2025 Internet Crime Report, this type of fraud, called business email compromise, produced 24,768 complaints and $3,046,598,558 in losses, about $123,000 per complaint, or roughly SAR 461,000. The fix costs almost nothing: never change a beneficiary's bank details on the strength of an email. Confirm by phone, using a number from your own records, and require a second person to approve the change. (We covered the approval side of payments in our article on the Binance hack and payment approval controls.)
What a phishing email looks like in 2026
The old advice was to look for spelling mistakes. That no longer works. The FBI report says chat generators can quickly produce official-sounding emails that imitate a company's CEO or other officials, and that voice cloning can be used to request a wire payment. In 2025 the FBI received more than 22,000 complaints that mentioned artificial intelligence, with losses above $893 million, and businesses reported more than $30 million lost to business email compromise involving AI.
So judge the request, not the writing. The warning signs that still hold:
- A change to bank details, especially just before a large payment is due.
- Urgency and secrecy: "pay today", "I'm in a meeting, don't call", "keep this confidential".
- A sender address that is almost right: one letter changed in the domain, or a free email account instead of the company domain.
- A request that skips your usual process: a manager asking an accountant directly to transfer money outside the system.
The numbers behind the problem
The FBI's Internet Crime Complaint Center (IC3) received 1,008,597 complaints in 2025, with reported losses of $20.877 billion, a 26% increase over 2024. Phishing and spoofing alone generated 191,561 complaints. Business email compromise complaints rose from 21,442 in 2024 to 24,768 in 2025. These are complaints filed in the United States, not Saudi figures, but the method is the same everywhere: the criminal does not break into your bank, they convince your own employee to send the money.
The same report holds the most useful lesson for any finance team: speed. When victims reported quickly, the FBI's Recovery Asset Team worked with banks to freeze funds. Across 3,900 incidents in 2025, it froze $679,013,183, a 58% success rate. The FBI's own advice is that time is of the essence: contact your bank immediately and ask it to recall the transfer.
6 steps that protect your company
- A callback rule for every bank detail change. Any request to change a supplier's, employee's or partner's account is confirmed by phone, using the number already in your records, never the number in the email. Write it down as policy so no one feels awkward asking.
- Two people for new beneficiaries. One person enters the new IBAN, a different person approves it, on a different device. Ask your bank to enable this on its corporate portal.
- Multi-factor authentication on email. The National Cybersecurity Authority's Email Protection Standard template requires MFA for webmail access and mobile email apps, and for email administrators. Most business email compromise starts with a stolen email password.
- SPF, DKIM and DMARC on your domain. The same NCA template requires these three records, so other servers can reject emails that pretend to come from your domain. They protect your customers and suppliers from fake emails in your name.
- Filtering and an external sender warning. The NCA template requires blocking inbound messages with malicious links or phishing attempts and quarantining medium-risk messages. Add a visible banner on every email from outside the company.
- A one-page response plan. If money went out: call the bank at once and request a recall, change the email password, check the mailbox for forwarding rules you did not create, and warn the supplier whose name was used.
What to teach your staff in 15 minutes
You do not need a long course. Teach three habits: check the sender's full address, never act on a payment request that arrives only by email, and report a suspicious message instead of deleting it. Then send a harmless test email once a quarter and discuss the results without blaming anyone. A team that reports quickly is worth more than a team that never clicks.
The Origami view
We see phishing as a process problem more than a technology problem. Email filters will always miss some messages, and AI makes fake emails more convincing every month. What does not change is the rule inside your systems: a bank detail change should be impossible without verification and a second approval. When we build custom accounting, procurement or payment systems, we put that rule in the system itself, with a log of every change to beneficiary data, so it does not depend on someone remembering. If you want a review of your email setup and payment approvals, contact us or see our services.
Sources
- FBI Internet Crime Complaint Center — 2025 IC3 Annual Report: total complaints and losses, business email compromise and phishing figures, AI-related complaints, and Recovery Asset Team freeze results.
- National Cybersecurity Authority — Email Protection Standard template: requirements on MFA, SPF, DKIM, DMARC, and blocking phishing messages.
Frequently asked questions
How can I tell if an email asking to change a supplier's bank account is fraudulent?
You often cannot tell from the email itself, because AI now writes convincing messages. Treat every bank detail change as suspicious until confirmed by phone using the supplier number already in your records, not the one in the email.
We transferred money to a fraudster. What should we do first?
Call your bank immediately and ask it to recall the transfer; speed matters most. Then change the email password, check the mailbox for forwarding rules you did not create, and warn the supplier whose name was used.
Are SPF, DKIM and DMARC enough to stop phishing?
No. They stop others from sending emails that pretend to come from your own domain, which protects your customers and suppliers. They do not stop a lookalike domain or a hacked supplier mailbox, so you still need the callback rule and two-person approval.
Is staff training still useful if AI writes perfect emails?
Yes, but change what you teach. Instead of spotting spelling mistakes, teach staff to judge the request: any change to bank details, urgency, secrecy, or a payment outside the normal process should be verified and reported.
