Business Email Compromise in 2025: How Attackers Chain Breach Data and LinkedIn to Steal from Small Firms

Business email compromise is no longer a blunt instrument. In 2025, it is a precision weapon – assembled from data your employees and principals have already surrendered to the internet, piece by piece, over years. The FBI’s Internet Crime Complaint Center (IC3) 2024 annual report recorded more than $2.77 billion in losses attributable to business email compromise schemes, making it the single highest-loss crime category the IC3 tracks. What that number hides is the shift in how attacks are built: attackers are no longer guessing. They are researching. They construct detailed dossiers on firm principals using publicly available breach archives and LinkedIn, then craft wire fraud requests so accurate in context and detail that even skeptical, experienced employees approve them.

1. The Threat Landscape: What Changed in 2024 and 2025
2. Who It Affects: Why Small Professional Services Firms Are Primary Targets
3. The Exact Methodology: Dossier Building Step by Step
4. Real Examples: When the Data Chain Worked
5. Defense Posture: What a Hardened Firm Actually Looks Like
6. What to Ask Your IT Firm Right Now

The Business Email Compromise Threat Landscape: What Changed in 2024 and 2025

For most of the last decade, business email compromise followed a simple formula: spoof a CEO’s email address, send a wire transfer request to the CFO, and hope the CFO didn’t look closely at the sender domain. That generation of attack still exists – but it looks amateur compared to what sophisticated groups are running today.

The critical shift is the commoditization of intelligence. Breach data that once circulated only on private dark-web forums is now indexed in searchable public repositories. According to the Identity Theft Resource Center, 2023 set a record for disclosed data compromises in the United States, and 2024 maintained that pace. Every large breach – whether from a payroll provider, a hotel rewards program, or a healthcare network – adds another layer of personal detail to a growing pool that attackers can query for free or a few dollars per lookup.

At the same time, LinkedIn has become the most comprehensive professional intelligence database ever assembled – and it is almost entirely public by default. Job titles, reporting structures, tenure dates, educational backgrounds, conference appearances, and even the names of key vendors or clients show up in profiles and posts. Combine leaked breach data with LinkedIn reconnaissance, and the resulting picture of a firm principal is extraordinarily detailed.

CISA has specifically flagged the combination of open-source intelligence gathering and credential data reuse as an accelerating precursor pattern to financial fraud. Their advisories on advanced persistent threat precursor activity note that initial reconnaissance phases have grown longer and more systematic – attackers spend weeks building context before sending a single email.

Who It Affects: Why Small Professional Services Firms Are Primary Targets

Large organizations have, by necessity, built layered approval workflows, dual-control treasury systems, and dedicated fraud operations teams. Small professional services firms – accounting practices, consulting groups, law offices, engineering firms, staffing agencies – typically have none of that. A managing partner’s wire transfer request goes to one person, and that person has been trained, culturally, to move quickly.

The FBI IC3 2024 data shows the median loss per incident is actually higher for smaller organizations than for large enterprises. Large companies lose more in absolute terms but recover more through internal controls and faster detection. Small firms lose amounts that frequently represent months of operating profit – and they almost never recover the money.

Professional services firms also have two characteristics that make them especially attractive intelligence targets. First, their principals are highly visible. Managing partners, executive directors, and firm founders maintain active LinkedIn profiles because business development depends on it. Second, their financial activity is predictable. Accountants wire money at quarter-end. Law firms send escrow disbursements around closings. Consulting firms pay contractors on net-30 cycles. An attacker who understands a firm’s calendar can time a fraudulent request to land when it looks entirely routine.

The firms most at risk share a specific profile: fewer than 50 employees, a principal whose name appears on the firm’s website and LinkedIn, at least one administrative staff member with authority to initiate or approve transfers, and a history of remote or vendor payments. That profile fits a very large share of the professional services market.

The Exact Business Email Compromise Methodology: Dossier Building Step by Step

Understanding how these attacks are constructed is the first step toward disrupting them. The chain typically unfolds across five phases, each feeding intelligence into the next.

Phase 1: Target Selection from Breach Aggregators

The attacker begins not with LinkedIn but with breach data. Services like Have I Been Pwned index hundreds of breaches publicly. Underground aggregators go further, combining name, email, phone, physical address, and in many cases hashed or plaintext passwords from multiple breach events. The attacker queries these repositories for individuals matching a professional profile – principals of accounting firms in a given metro area, for example – and returns a list of targets with associated email addresses and, critically, password history.

Phase 2: Password Reuse Validation

Password reuse remains epidemic. A 2024 analysis by SpyCloud found that 61 percent of passwords exposed in breaches had been reused across multiple accounts. The attacker takes the principal’s historical passwords from breach data and tests them – automatically, at scale – against webmail portals, remote access systems, and cloud file-sharing platforms. If any credential works, the attacker gains read access to the principal’s inbox. From that position, they observe without touching anything: learning communication style, vendor relationships, pending transactions, and the names and writing habits of key staff.

Phase 3: LinkedIn Reconnaissance

Simultaneously, the attacker builds a LinkedIn dossier on the principal and their staff. They note who reports to whom, who handles accounts payable, who has recently been promoted or is new enough to want to prove their competence. They scrape post histories for travel announcements – a principal posting about an industry conference has just explained why they are unreachable for in-person verification. They note vendor mentions in posts and comments.

Phase 4: Contextual Dossier Assembly

The attacker now combines the inbox intelligence with the LinkedIn map. They know the principal’s writing cadence – formal or casual, does he close with “Thanks” or “Best” – the names of contacts at the firm’s bank, any pending large transactions referenced in emails, and which staff member has both the authority and the disposition to act quickly under pressure. This is not guessing. This is structured research, and it produces a target profile more detailed than most firms maintain about themselves.

Phase 5: The Strike

The fraudulent request lands in the right person’s inbox. It comes from a spoofed domain that mimics the principal’s email address by one character – or, in the most sophisticated cases, directly from the principal’s compromised account. The message references a real vendor, a real transaction context, and a real urgency tied to the principal’s known travel. It asks for a wire to a new account, framing the change as routine. Because the contextual details check out, the employee’s skepticism doesn’t fire. They wire the money. This is business email compromise at its most refined.

Real Examples: When the Data Chain Worked

The following examples are drawn from publicly reported incidents and FBI IC3 case summaries. No firm names are used beyond what is already public record.

• A mid-Atlantic law firm lost $2.3 million in a single wire transfer after an attacker compromised the managing partner’s email through a reused credential from a 2022 hotel loyalty program breach. The attacker observed the inbox for 11 days before sending a fraudulent escrow disbursement instruction to the firm’s bookkeeper – referencing an active real estate closing by name.
• A 12-person financial advisory consulting firm was targeted through a spoofed domain after an attacker identified on LinkedIn that the office manager had recently taken over accounts payable responsibilities. The attacker’s email opened by congratulating the employee on the new role – drawn directly from a LinkedIn post – before requesting an urgent vendor payment reroute.
• An accounting practice lost $180,000 when an attacker timed a fraudulent payroll redirect request to coincide with the managing partner’s attendance at a conference. The conference appearance had been announced publicly on LinkedIn three weeks earlier, giving the attacker time to prepare the request and choose the optimal send date.

None of these attacks required extraordinary technical skill. They required patience, research, and access to data the targets had already exposed. Each is a textbook business email compromise scenario enabled entirely by open-source intelligence.

Defense Posture: What a Hardened Firm Actually Looks Like

Defending against this attack pattern requires controls that address each phase of the chain. A firm that plugs one phase but leaves the others open remains exposed. Here is the layered posture that meaningfully reduces risk.

Credential Hygiene and Monitoring

Every principal and staff member with financial authority needs unique, complex passwords managed through a business password manager – not a browser vault, not a shared spreadsheet. Password managers that generate unique credentials per site eliminate the reuse chain that gives attackers inbox access. Equally important: enroll in continuous breach monitoring that alerts you when a firm email address appears in a newly disclosed breach dataset. Early detection of a compromised credential can disrupt the attacker’s reconnaissance phase before the fraudulent message is ever sent.

Phishing-Resistant Multi-Factor Authentication

Standard text-message multi-factor authentication is better than nothing, but it is increasingly bypassable through real-time phishing proxies. Phishing-resistant methods – hardware security keys or passkey-based systems – prevent an attacker from intercepting a one-time code and replaying it. Every account with access to email, financial systems, or cloud file storage should require this level of authentication.

Wire Transfer Verification Protocols

No wire transfer above a defined threshold should ever be approved through email alone. The protocol should require an out-of-band confirmation – a phone call to a number already on file, not one provided in the email – before any transfer is initiated. This one control stops the final phase of virtually every business email compromise attack, because the attacker cannot participate in a voice call without revealing themselves.

LinkedIn Awareness Training

Staff who manage accounts payable need to understand that their LinkedIn profile – and their principal’s profile – is read by threat actors as regularly as it is read by recruiters. Training should cover what information is appropriate to share publicly, how to recognize when an email is exploiting social context (referencing a trip, a promotion, a new vendor relationship), and what to do when a request creates urgency that bypasses normal process. Our cybersecurity practice treats this as a standing element of client training, not a one-time checkbox.

Email Authentication Infrastructure

Properly configured email authentication – specifically DMARC set to a reject policy, with DKIM and SPF aligned – prevents attackers from spoofing your domain to target your own staff or your clients. A surprising number of small professional services firms have no DMARC record at all, or have it set to monitor-only, which generates reports but stops nothing. Verifying your domain’s authentication posture takes minutes and is one of the highest-return controls available against business email compromise via domain spoofing.

Inbox Access Auditing

If an attacker gains read access to a principal’s inbox, they will not announce themselves. They will not delete emails, forward messages, or change settings in ways that trigger obvious alerts. What they will do is create quiet inbox rules that forward copies of specific emails to an external address. Regular auditing of inbox rules – across all accounts with financial or operational authority – is a simple but frequently skipped control that can surface a silent compromise before the fraudulent request is ever sent.

What to Ask Your IT Firm Right Now

The following questions will tell you quickly whether your IT firm is thinking about this threat pattern or not. A firm that cannot answer these with specifics – not generalities – is not providing the level of coverage this environment demands.

• Are our email domains fully authenticated with DMARC at a reject policy, and can you show us the current configuration and reporting?
• How would we know today if one of our principals’ email accounts had a silent forwarding rule installed by an unauthorized party?
• What breach monitoring is in place for our firm’s email addresses, and how quickly would we be notified if our credentials appeared in a new breach dataset?
• Which staff members who handle financial transactions are using phishing-resistant multi-factor authentication, and which are still on text-message codes?
• Have you reviewed our wire transfer approval process, and what out-of-band verification step exists before a transfer is executed?
• When did we last audit inbox rules on executive and finance team accounts, and what did that audit find?

These are not advanced questions. They are baseline questions. If the answers are vague, incomplete, or amount to “we’d need to check on that,” your firm’s exposure is higher than it should be.

It is also worth examining your managed IT relationship through the lens of what a fully managed IT engagement should include – specifically whether the firm handling your infrastructure has visibility into email configuration, credential monitoring, and user-level access controls, or whether those areas are silently unmanaged.

The Uncomfortable Truth About 2025 Threat Actor Methods

The attacks documented in the FBI IC3 2024 report are not primarily technical achievements. They are research achievements. The attackers generating billions in fraud losses are not breaking sophisticated encryption or bypassing hardened network perimeters. They are reading LinkedIn, querying breach databases, and waiting patiently in compromised inboxes until the moment is right.

That reframing matters for how firms think about their exposure. The question is not only “are our systems secure” – it is “how much does an attacker already know about us, and what would they do with that knowledge?” A firm whose technical defenses are average but whose principals have highly public digital footprints and no wire verification protocol is more exposed than a firm with less sophisticated infrastructure but a disciplined operational process around financial transactions.

The firms that get through this environment without losses will be the ones that take the research-and-context threat as seriously as they take the technical threat. Both dimensions need to be covered. In 2025, covering only one of them is not a security posture – it is a gap with a dollar value attached to it. Business email compromise will remain the top financial fraud category precisely because it exploits the intersection of human trust and publicly available data, and that intersection is not going away.

For further reading on how the FBI categorizes and tracks these schemes, see the FBI Internet Crime Complaint Center (IC3), which publishes annual Internet Crime Reports with business email compromise-specific loss data and trend analysis.

Want to know where your firm stands? Book a Free Cybersecurity Strategy Call – a 20-minute conversation with our team, no obligation, no pressure.