Five years of email attacks: what changed, and what did not

What this archive holds

This archive documents 25 email attacks from 2021 to 2026, each with at least two independent sources. Thirteen were payment fraud: an email asked someone to send money to a new account, and they did. Eight used email to break into an organisation, through an attachment, a fake login page or a crafted file. Four showed that an email could steer the AI assistant that reads it. The cases are listed by year in the summaries below.

The numbers

The FBI's Internet Crime Complaint Center has counted the same categories every year. Its five annual reports for 2021 to 2025 tell one clear story.

FBI IC3 annual reports, 2021 to 2025
Year	All complaints	All losses	Phishing and spoofing complaints	BEC complaints	BEC losses
2021	847,376	$6.9 billion	342,494	19,954	$2.40 billion
2022	800,944	$10.3 billion	321,136	21,832	$2.74 billion
2023	880,418	$12.5 billion	298,878	21,489	$2.95 billion
2024	859,532	$16.6 billion	193,407	21,442	$2.77 billion
2025	1,008,597	$20.9 billion	191,561	24,768	$3.05 billion

The phishing figures for 2021 and 2022 are the merged values IC3 restated in its 2023 report, so the column compares like with like. BEC stands for business email compromise.

Complaints about phishing fell by nearly half over five years. Losses to business email compromise rose by more than a quarter, to over $3 billion in 2025. Added up, the five reports record about $13.9 billion in adjusted losses to business email compromise. Phishing was reported less often. The targeted email that asks for money cost more every year but one.

Lookalike domains

The cheapest disguise appears in every year of the archive. Peterborough's fraudsters wrote as an engineering firm with "Tanner" spelled "Tanerr". Cottage Grove's impostor added "inc" to the sewer contractor's domain. Milwaukee's used scherrerconstruction.us in place of .com. The campaign behind the Dropbox breach registered circle-ci.com and circle-cl.com. The npm maintainer's phish came from npmjs.help, registered three days before.

The defence that answers it also appears in the archive. After its own case in 2022, Boulder County set its mail tools to warn about newly registered domains and domains one or two characters away from its partners'.

Hijacked threads and compromised mailboxes

The more careful fraudsters did not write as strangers. They wrote from inside. At Portland's Housing Bureau the impostor used a real city mailbox. In New Haven the attackers read a school manager's mail for weeks before writing as the bus company. At Eagle Mountain and Pine Bluff the fake payment instructions arrived inside a genuine thread about a real invoice. At IEH Corporation and in Arlington, Massachusetts, the intruders set mailbox rules to hide what came in.

A request from a genuine account passes every sender check. That is why the rule that worked, wherever the archive records one, ignored the email entirely: call the vendor on a number already on file before paying anywhere new.

MFA fatigue and relayed codes

Multi-factor authentication changed the attack more than it stopped it. In 2022 Uber said an attacker sent a contractor repeated approval requests until one was accepted. Cisco Talos described voice calls combined with repeated push prompts. Those attacks used phones and push notifications, not email. In 2023 Microsoft described Midnight Blizzard asking targets in Teams chats to enter a code in Microsoft Authenticator.

Email played its part through fake login pages that relay a one-time code as soon as it is typed. That is how the Dropbox and npm accounts were taken. The defence that held is in the record too. When the same kind of fake page reached Cloudflare staff by text message in 2022, three of them entered their credentials and the logins still failed, because their FIDO2 hardware keys answer only the genuine site. Dropbox accelerated its own move to such keys after its breach.

AI-written lures

In July 2023 SlashNext described WormGPT, a chatbot sold to criminals for writing business email compromise lures. In December 2024 the FBI warned that criminals use generative AI to write believable messages faster and to remove the spelling and grammar mistakes that once gave them away. In a study published in 2024, Fred Heiding and colleagues, including Bruce Schneier, found that fully AI-written spear-phishing emails were clicked by 54% of recipients, the same rate as emails written by human experts, against 12% for a generic phishing email.

The FBI's report on 2025 was the first to count complaints that mention AI: 22,364 of them, with $893,346,472 in losses, including $30,256,592 in business email compromise. Verizon's 2025 report said synthetically generated text in malicious emails had doubled over two years.

The lesson for readers is about where to look. A clean, well-written email in your supplier's tone is no longer evidence of anything. The tells that remain are facts: where the link really goes, which domain really sent the message, and what it pushes you to do.

Attacks on AI assistants

The newest pattern runs through 2024 to 2026. Johann Rehberger showed in 2024 that an email could make Microsoft 365 Copilot search a mailbox and hide the results in invisible characters inside a link. In 2025 EchoLeak showed that one unopened email could make Copilot send internal data out. A report through Mozilla's 0DIN programme showed hidden white text turning a Gemini summary into a fake Google alert. Radware's ShadowLeak made ChatGPT's Deep Research agent send inbox data to an attacker. In 2026 Radware's ZombieAgent got around the fix, and Permiso showed hidden text making Copilot in Outlook display a fake security alert.

In the sources this archive checked, every one of these was a researcher's demonstration, and every one was fixed by the vendor. None was confirmed as used to steal data in a real attack. The pattern across them is consistent all the same. Text a person cannot see is text an assistant still reads, and the assistant speaks with the authority of the product it is part of.

What changed in defences

Call-back rules became written policy. Peterborough presented its lessons to other towns in 2022. Pine Bluff added dual authorisation and verbal confirmation in 2026. The vendor's advice in the CityHousing Hamilton case was the same rule, sent two weeks too early.
Banks and police got faster at freezing money. Fort Lauderdale, Boulder County, Milwaukee and Dickinson recovered everything they lost. IC3's Recovery Asset Team reported success rates between 71% and 74% on the business email compromise cases it worked from 2021 to 2023.
Phishing-resistant sign-in spread. Hardware keys and passkeys check the real address of a website, so a lookalike page gets nothing.
Vendors fixed assistant flaws on their own servers. EchoLeak and the 2026 Copilot flaw were fixed before most users heard of them.

What did not change is the request itself. In 2021 and in 2026 alike, an email asked a person to pay a known partner at a new account, and the person did.

What this archive leaves out

Several famous attacks are not here, because the sources show they did not start with an email, or do not say how they started. Change Healthcare's attackers used stolen credentials on a remote-access portal without multi-factor authentication. Snowflake's customers were reached with credentials from infostealer malware. The 0ktapus campaign against Twilio and Cloudflare used text messages. Orion and Pepco lost about $60 million and €15.5 million to fraud, but neither said it arrived by email. Each is explained in its year's summary.

The archive also starts in 2021. Three cases often cited as email fraud fall before it: the Toyota Boshoku subsidiary's loss of about $37 million in August 2019, the Puerto Rico Industrial Development Company's loss of over $2.6 million in January 2020, and the sentencing of Evaldas Rimasauskas in December 2019 for the fake-invoice fraud against Facebook and Google.

What a warning inside the message adds

Most cases in this archive turned on a fact that sat in the message itself. A domain differed by a letter or an ending. A request asked to change payment details. A link led somewhere unrelated to the sender. Text was hidden from the reader and aimed at an assistant. Antilure is a phishing detector built to put such facts in front of the reader, at the moment they read. It runs on the computer, with a model of about 13 MB that checks a typical message in under 25 ms, and nothing in the mail leaves the computer. On risky mail in Gmail and Outlook it draws a banner inside the message with an action line, and marks the phrases that push the reader to act.

It works alongside the call to a known number. It puts the reason for that call on the screen, inside the message, at the moment the reader decides.

Sources

Internet Crime Report 2021, FBI IC3, 22 March 2022.
Internet Crime Report 2022, FBI IC3, March 2023.
Internet Crime Report 2023, FBI IC3, 6 March 2024.
2024 IC3 Annual Report, FBI IC3, 23 April 2025.
2025 IC3 Annual Report, FBI IC3, 6 April 2026.
Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud, FBI IC3, 3 December 2024.
Study of fully automated AI spear phishing, arXiv 2412.00586, Fred Heiding and others, arXiv, 30 November 2024.
2025 Data Breach Investigations Report, Verizon, April 2025.
WormGPT: The Generative AI Tool Cybercriminals Are Using to Launch Business Email Compromise Attacks, SlashNext (via Security Boulevard), 13 July 2023.
Security update, Uber, September 2022.
Cisco Talos shares insights related to recent cyber attack on Cisco, Cisco Talos, 10 August 2022.
The mechanics of a sophisticated phishing scam and how we stopped it, Cloudflare, 9 August 2022.
Midnight Blizzard conducts targeted social engineering over Microsoft Teams, Microsoft Threat Intelligence, 2 August 2023.
BleepingComputer report on the Toyota Boshoku loss, Sergiu Gatlan, BleepingComputer, 6 September 2019.
Associated Press report on the Puerto Rico loss, Dánica Coto, Associated Press via PBS NewsHour, 12 February 2020.
The Register's report on the Rimasauskas sentencing, Shaun Nichols, The Register, 20 December 2019.