Agari analyzed 59,652 unique messages accessed from 78 criminal email accounts to produce its report. The researchers analyzed a variety of email-based attacks, including romance and rental scams, but even though BEC did not emerge as a trend until 2016, BEC attacks accounted for 24% of all attacks analyzed. BEC attacks produce more victims and result in higher dollar losses than any other criminal email attack.

Key findings from the report include:

• Research revealed criminal email accounts request payments ranging from $1,500 to more than $200,000, with an average request of $35,500. Additionally, Agari categorized hundreds of bank accounts, social security numbers, passwords and PINs that organized crime groups obtained through social engineering, BEC and account takeover.
• Nine out of the 10 criminal email groups appear to operate out of Nigeria. Agari correlated many of these criminal email accounts with social media profiles and other personal registrations, producing a clear picture of their true identities.
• Even though BEC attacks only have an initial response rate of 32 percent, they are also ten times more likely to produce a victim if the target answers an initial probe email, such as “Are you at your desk to make a payment?”
• Romance scams, which accounted for 11% of all attacks, are also ten times more likely to produce a victim if the target answers an initial probe. Agari mentioned a Florida woman who exchanged more than 1,500 emails with an email scammer, believing him to be a wealthy expatriate living in Dubai. Over the course of six years, this woman lost more than $500,000 and had to sell her home after refinancing it to help pay a variety of fraudulent requests.
• Agari identified a sophisticated actor compromised email accounts belonging to real estate brokers by sending them malware-infected documents. This scammer leveraged these compromised email accounts to conduct account takeover-based escrow scams that could potentially bankrupt targets. Agari believes this individual, who appears to be operating out of Kenya, is in the United States.

“Business email compromise has become a pervasive threat — it is the most popular, the most effective, and the most damaging of all of the attacks we research,” Peterson said. “These organized crime groups will not stop these attacks, but whenever possible, Agari will be there to capture these criminal email accounts, to freeze their mule bank accounts and to pull back the mask of their true identity.”