Business Email Compromise Persists as Actors Refine Tactics

STG Logistics CISO on BEC Compromise, AI and Web Scraping Michael Novinson (MichaelNovinson) • November 17, 2025

Business email compromise is still one of the most active and costly forms of cybercrime. Using phishing and social engineering, threat actors abuse employee's trust and familiarity with certain tools or sites as an entry point.

See Also: Mastercard on Agentic Payments: How AI Agents, Tokenization, and Authentication Will Redefine Digital Commerce

But scammers aren't just submitting fake invoices and spoofing emails. They are also scraping websites, mirroring login portals and using compromised customer and vendor accounts to launch fraud campaigns. With the proliferation of artificial intelligence tools and deepfake technologies, organizations are struggling to distinguish real requests from fake ones.

"BEC is now so well-crafted that you're very easily fooled,” said Scott Fitzgerald, CISO at STG Logistics. “We see websites being scraped to look like ours, fake invoices, fake truck ...