Table of Contents
Executive Summary
Fortra Intelligence Research Experts have been monitoring the latest trends in Business Email Compromise (BEC) attacks. In March 2025, we observed an increase in BEC attack volume of 4%, with gift cards accounting for 32.6% of all attacks.
The majority of financial scams involved gift card fraud. We also noted a notable increase in cryptocurrency scams, with 70 reported cases affecting 66 wallets. Attackers are increasingly exploiting decentralized finance for rapid laundering.
The average requested wire transfer increased to $72,396, a 84% rise from the previous month, with major US banks targeted in 36% of cases. The widespread use of non-corporate email accounts continues to undermine authentication security, as 74% of BEC attacks originated from free webmail providers.
Here are the key findings:
BEC attack volume increased by 4%, with Gift cards accounting for 32.6% of all attacks.
Cryptocurrency scams involved 70 reported cases, affecting 66 wallets.
The average requested wire transfer increased to $72,396, a 84% rise from the previous month.
Major US banks were targeted in 36% of wire transfer cases.
74% of BEC attacks originated from free webmail providers.
Vishing scams utilized 17 fraudulent phone numbers linked to 7 brands.
The majority of BEC attacks came from Nigeria (43%), followed by United States (39%).
BEC Attack Trends
During the month of March 2025, FIRE observed an increase of 4% in overall attack volume in comparison to the prior month.
Gift cards were the most common cash out method (32.6%), followed by advanced fee frauds (24.6%), payroll diversions (6.8%), credential phishing (6.3%), cryptocurrency (4.0%), wire transfers (1.6%), and vishing (1.1%). Twenty-three percent of the attacks in March 2025 requested various other types of payments.
Cryptocurrency
Throughout the month of March, FIRE identified 70 cryptocurrency-related scams and recorded 66 unique wallets used by scammers. The average amount requested by scammers during March was $12,748.60, with requests ranging from a minimum of $1,094.03 to a maximum of $45,763.00.
BEC Wire Transfers
Wire transfer BEC attacks decreased by 7% in March (see Figure 2).
The average amount requested from BEC wire transfer attackers was $72,396 in March compared to $39,315 in February 2025, an increase of 84%. During the month of March, 33% of wire transfer BEC attacks requested less than $10,000, while 43% of wire transfer BEC attacks requested between $10,000 and $50,000. For the other 24% of wire transfer BEC attacks, 5% requested between $50,000 and $100,000 and 19% requested more than $100,000.
During the month of March 2025, major US banks proved to be the most common institutions of choice for wire transfer scammers, comprising 36% of the total. This type of bank was followed by regional US banks (25%), specialty banks (14%), and international (non-US) banks (11%).
BEC Payroll Diversions
During the month of March 2025, regional US banks proved to be the most common institutions of choice for payroll diversion scammers, comprising 23% of the total. This type of bank was followed by specialty banks (23%), online banks (22%), major US banks (20%), and international (non-US) banks (8%).
BEC Infrastructure
74% of BEC attacks were sent from email addresses hosted on free webmail providers compared to 26% of attacks sent from maliciously registered domains. The percentage of free webmail providers used increased in March compared to 73% in February 2025.
For March 2025, Google was the primary webmail provider used by actors to send BEC campaigns, comprising of 72% of the 1,113 free webmail accounts used by scammers. Other popular webmail providers included Microsoft and Verizon Media.
BEC Attack Locations
Nigeria was the primary location¹ linked to BEC threat actors in March, with nearly 43% of all BEC actors originating from Nigeria-based IP addresses. United States was next, with 39% of the total attackers located there.
¹ Attacker locations are identified IP addresses collected by beacons that are inserted into our communications with BEC actors. IP addresses that are overtly associated with VPNs or other proxies are removed from this dataset; however, there is still a possibility that a device associated with an IP address could be used as a proxy in other ways, so the location (particularly for those outside West Africa) cannot be deemed completely definitive.
Cybercrime Intelligence Shouldn't Be Siloed
Fortra® experts are dedicated to protecting organizations and the public by delivering the latest insights, data, and defenses to strengthen security against emerging cyber threats.
