Fortra published its BEC Global Insights Report for October 2026 on 2 November 2026, and the most useful finding for anyone defending email is about infrastructure. During October, 63% of business email compromise attacks observed by the Fortra Intelligence and Research Experts team, known as FIRE, were sent from email addresses hosted on free webmail providers. Only 37% originated from maliciously registered domains. The share of free webmail even grew from 60% in September.
The report draws on hundreds of active defense engagements with BEC threat actors that FIRE conducts every month, which gives it an unusually direct view of how attackers ask for money and where they send their mail from.
Volume fell, but the money requests did not stop
FIRE observed a 36% decrease in overall BEC attack volume in October compared to September. The tactics underneath that number stayed remarkably consistent, however. Gift cards remained the most prevalent cash out method, accounting for 57.5% of attacks, followed by advanced fee frauds at 22.6% and wire transfers at 12.2%.
Apple Store gift cards were the most frequently requested, representing 50% of all gift card requests, with Amazon at 31.8% and Sephora at 4.5%. The cryptocurrency picture was small but persistent: 8 crypto related scams were identified, involving 5 unique Bitcoin wallet addresses, with requested amounts ranging from $1,270 to $3,300 and an average request of $2,437.50.
Wire transfer attacks got more frequent and slightly cheaper
Wire transfer attacks increased by 16% in October compared to September, while the average amount requested dropped 18% to $41,779 from $50,943. The distribution is a reminder that BEC is not only a seven figure boardroom fraud. Requests under $10,000 made up 24% of the total, amounts between $10,000 and $50,000 accounted for 46%, requests between $50,000 and $100,000 for 27%, and only 4% exceeded $100,000.
The mule accounts receiving these transfers were dominated by major US banks at 37%, followed by international non US banks at 15% and regional US banks at 13%. In payroll diversion attacks, FIRE identified 51 total banks, with Green Dot/Go2Bank at 27%, SoFi Bank at 10% and Bank of Montreal at 4% among the most used.
941 maliciously registered domains
The infrastructure section carries the real lesson. FIRE identified 941 maliciously registered domains during October, and 75% of them were registered through Google, followed by Microsoft and Seznam. Among free webmail based attacks, the top three services used were Spaceship, Wild West Domains and NameCheap, which together represented 42% of all webmail based attack mail.
Geographically, the United States accounted for 39% of attacks by identified IP address and Nigeria 28%, with Fortra noting that locations outside West Africa cannot be deemed completely definitive because a device behind an IP could act as a proxy.
Why this matters for DMARC
The split between webmail and registered domains maps exactly onto the two halves of the impersonation problem. The 63% sent from free webmail is authenticated mail. It genuinely comes from the provider’s domain, it passes SPF, DKIM and DMARC checks, and no policy you publish on your own domain will stop it. Those attacks rely on the display name and the story in the body, which is why staff training and verification procedures for payment changes still matter.
The 37% from maliciously registered domains is where domain defense pays off. Attackers register lookalikes because spoofing your exact domain has become harder as DMARC enforcement spreads. A DMARC policy at p=reject closes the exact domain spoofing route, and monitoring your aggregate reports shows you which lookalike cousins are being used against your staff and customers. The 941 fresh registrations in a single month show that this is a continuous process, not a one time setup.
The report was authored by JT Newby, Principal Threat Research Lead at Fortra, and it is a useful monthly pulse check on how BEC operators actually cash out and where they send from.
Most BEC mail now arrives from infrastructure that passes authentication by default, which makes your own domain one of the few assets fully under your control. Excello Mail shows you exactly what is being sent as your domain and which lookalikes are circling it. Sign up for free to Excello Mail and take control of your domain’s identity.