A Single FakeEmail Cost This Company $37 Million

In 2024, the FBI's Internet Crime Complaint Center reported that business email compromise — attacks built on fakeemail messages that impersonate trusted senders — generated over $2.9 billion in adjusted losses. That made BEC the costliest cybercrime category for the fourth year running. One spoofed email. One trusting employee. One wire transfer to a threat actor's account.

If you think your organization is too small or too savvy to fall for a fakeemail, I'd challenge that assumption. I've investigated incidents at companies with dedicated IT teams, proper firewalls, and expensive endpoint protection — and all it took was one well-crafted spoofed message to bypass every technical control they had.

This post breaks down exactly how fakeemail attacks work, why they keep succeeding, and what your organization can do right now to shut them down.

What Is a FakeEmail Attack, Exactly?

A fakeemail is any message where the sender's identity has been forged or manipulated to deceive the recipient. The goal is simple: make the email look like it came from someone the target trusts — a boss, a vendor, a bank, or a coworker. Once trust is established, the attacker asks the victim to take action: click a link, open an attachment, send credentials, or transfer money.

There are three primary methods attackers use to create fakeemail messages:

  • Display name spoofing: The attacker sets their display name to match a known contact, like "Jane Smith - CFO," while using a completely unrelated sending address.
  • Domain spoofing: The attacker forges the "From" header to show a legitimate domain, exploiting organizations that haven't deployed email authentication protocols.
  • Lookalike domains: The attacker registers a domain nearly identical to the target's — think "yourcompanny.com" instead of "yourcompany.com" — and sends messages from it.

Each technique targets a different layer of human and technical defenses. And each one is devastatingly effective when the recipient isn't trained to spot it.

Why FakeEmail Attacks Keep Working in 2026

Here's what actually happens in most organizations I've assessed: employees process dozens or hundreds of emails a day. They scan sender names, not full addresses. They trust context over verification. And they operate under time pressure.

Threat actors know this. They craft fakeemail messages that align with normal business workflows — invoice approvals, password resets, shipping notifications, HR policy updates. The 2024 Verizon Data Breach Investigations Report found that the median time for a user to fall for a phishing email was less than 60 seconds. That's not carelessness. That's how humans process information under load.

Social Engineering Is the Real Weapon

The email itself is just the delivery mechanism. The real weapon is social engineering — the psychological manipulation that makes the recipient act without thinking critically. Urgency ("Your account will be locked in 30 minutes"), authority ("The CEO needs this done now"), and fear ("Your credentials have been compromised") are the levers attackers pull.

I've run phishing simulations where the fakeemail mimicked an internal IT notice about a mandatory password reset. Click rates hit 34% in the first 10 minutes. These weren't naive users. They were engineers, managers, and finance professionals who simply trusted what looked familiar.

Generative AI Has Raised the Bar

In years past, you could spot many fakeemail messages by their awkward grammar or odd formatting. That signal is gone. Threat actors now use generative AI to produce polished, context-aware messages that match the tone and style of the impersonated sender. Some even scrape LinkedIn and corporate websites to personalize the content. The result is a fakeemail that reads exactly like a legitimate message from someone you know.

The Technical Defenses You Should Already Have

Before we talk about training, let's cover the technical controls. If you haven't deployed these, you're leaving the front door unlocked.

SPF, DKIM, and DMARC — The Email Authentication Triad

These three protocols work together to verify that an email actually came from the domain it claims to represent:

  • SPF (Sender Policy Framework): Publishes a DNS record listing which servers are authorized to send email for your domain.
  • DKIM (DomainKeys Identified Mail): Adds a cryptographic signature to outgoing messages so the receiving server can verify they weren't tampered with.
  • DMARC (Domain-based Message Authentication, Reporting and Conformance): Tells receiving servers what to do when SPF or DKIM checks fail — and sends you reports about it.

CISA has repeatedly urged all organizations to implement DMARC at enforcement level (p=reject). Their Binding Operational Directive 18-01 required federal agencies to do exactly that. If the federal government considers it essential, your organization should too.

Multi-Factor Authentication Stops Credential Theft

Even if an employee clicks a link in a fakeemail and enters their password on a phishing page, multi-factor authentication (MFA) adds a second barrier. Phishing-resistant MFA — like FIDO2 hardware keys — is the gold standard. SMS-based MFA is better than nothing, but attackers have developed techniques like real-time phishing proxies (EvilGinx) that can intercept those codes.

NIST's Digital Identity Guidelines (SP 800-63B) provide detailed recommendations for implementing strong authentication. Follow them.

Zero Trust Limits the Blast Radius

A zero trust architecture assumes that any user, device, or session could be compromised. Even if a fakeemail leads to credential theft, zero trust principles — continuous verification, least-privilege access, network micro-segmentation — limit what the attacker can reach. It won't prevent the initial click, but it can prevent a data breach from becoming a catastrophe.

Training Is the Layer That Saves You

Technical controls catch known patterns. Training catches everything else. When I've reviewed post-incident timelines, the organizations that recovered fastest were the ones where employees recognized something felt off — and reported it before damage was done.

Effective security awareness training doesn't just teach people what phishing looks like. It builds the reflex to pause, verify, and report. That reflex is what stops a fakeemail from becoming a ransomware infection or a six-figure wire fraud.

If you're building or improving your security awareness program, our cybersecurity awareness training course covers the full spectrum — from social engineering tactics to credential hygiene to incident reporting. It's designed for real employees, not security professionals.

Phishing Simulations That Actually Change Behavior

Running phishing simulations once a year checks a compliance box. Running them monthly — with varied scenarios, immediate feedback, and no punitive consequences — actually changes behavior. I've seen organizations cut their click rates by over 60% within six months of consistent simulation programs.

Our phishing awareness training for organizations gives your team realistic simulation scenarios and actionable education built around the tactics threat actors are using right now. Not last year's tactics. Right now.

How to Spot a FakeEmail: A Quick Reference

This is the section you should share with every employee in your organization:

  • Check the full sender address. Not just the display name — hover over or expand the "From" field. Does the domain match exactly?
  • Look for urgency and pressure. Legitimate business requests rarely threaten account lockout or demand immediate wire transfers.
  • Verify through a second channel. If the CFO emails asking for a payment, call the CFO directly. Use a known number, not one in the email.
  • Inspect links before clicking. Hover over every link. Does the URL match the expected destination? Watch for lookalike domains with swapped characters.
  • Report, don't delete. If something feels wrong, forward it to your IT or security team. A deleted fakeemail can't be investigated. A reported one can protect the whole organization.

The $4.88M Lesson Most Organizations Learn Too Late

IBM's 2024 Cost of a Data Breach Report pegged the global average cost of a data breach at $4.88 million. A significant portion of those breaches started with a phishing email — a fakeemail that one person trusted for one moment.

You don't need a massive security budget to defend against this. You need three things: properly configured email authentication, multi-factor authentication on every account that matters, and a workforce trained to recognize and report suspicious messages.

The threat actors sending fakeemail messages to your employees aren't going to stop. They're going to get better. Your defenses need to get better faster.

Start with the technical controls. Then invest in your people. That combination is what separates organizations that read about breaches from organizations that become one.