BEC: The New-Generation Wire Fraud That Bypasses MFA
No malware, no ransomware, no antivirus alert. Just a link, a stolen session, and a wire transfer that lands in the wrong account. Why business email compromise (BEC) now puts West Africa at the center of the world map — and why classic MFA isn't enough to stop it anymore.
October 22, 2026 · SunuCyberSecurity Team
of global BEC attacks detected in April 2026 originated from Nigeria — ahead of the United States (34%)
increase in global BEC attack volume observed in a single month (March → April 2026)
of reported cybercrimes in Africa are now AI-linked, per INTERPOL's latest report
malware needed: a stolen mail session captured after authentication is enough to do it all
Sources: INTERPOL African Cyberthreat Assessment Report 2026; Fortra BEC Global Insights Report, April 2026 (global data) — full list at the end of this article
BEC — Business Email Compromise, long known in business circles as "CEO fraud" or fraudulent wire transfer — doesn't need to breach a firewall or encrypt a hard drive to cause damage. All it needs is a corporate mailbox, one moment of inattention, and a now well-rehearsed technique that bypasses MFA without ever "breaking" it. In its 2026 report, INTERPOL describes BEC and romance scams as "prolific" in Central and West Africa — a region that also concentrates a significant share of the infrastructure used to run these attacks globally.
West Africa, at the center of the global BEC map
INTERPOL's latest report (data from 36 African countries, published 2026) is blunt: over half of reported cybercrime on the continent is now AI-linked, used in particular to generate far more convincing phishing emails than before. The report specifically places BEC and romance scams as "prolific" in Central and West Africa, and notes a particularly strong concentration of organized scam centers in Southern and West Africa.
This central position is confirmed on the attack-infrastructure side too: per Fortra's global data, Nigeria was in April 2026 the top country of origin for detected BEC attacks worldwide (36% of cases), ahead of the United States (34%) — with attack volume up 151% in a single month. That figure needs to be read for what it actually measures: the origin of the infrastructure (IP addresses, free webmail accounts used in 57–69% of campaigns depending on the month), not where the victims are. Being a major source of BEC attacks does not mean being spared as a target.
On the regional victim side, esentry's "Eye of Horus" report (H1 2026) offers a concrete, if not exclusively BEC-specific, signal: roughly 1 billion naira in fraud evaded automated controls at West African institutions over that period, including three separate incidents affecting Nigerian fintech, payments and core-banking organizations — detected only through audits, support tickets, or settlement alerts, never by the detection systems themselves. That's compromised-access fraud in the broader sense, not an isolated pure-BEC loss figure — but it illustrates the same blind spot: automated systems that don't flag a session that looks perfectly legitimate.
The real mechanism: how a stolen session is enough
The most sophisticated BEC attacks of 2026 no longer steal a password — they steal an already-authenticated session. The technique is called AiTM (adversary-in-the-middle), and it unfolds in seven well-documented steps:
1
The link
A highly targeted email, often AI-generated or AI-polished, referencing a real invoice, a real vendor, or a plausible urgency. The link points to a fake Microsoft 365 or Google Workspace login page, visually identical to the real one.
2
The invisible proxy
This fake page isn't a simple form stealing a password — it's a reverse proxy (adversary-in-the-middle, or AiTM) relaying everything the victim types to the real login service, live.
3
The session theft
The victim enters their password and completes MFA normally — SMS code, push notification, everything works as usual. But the proxy captures the session token generated AFTER that successful authentication.
4
The replay
The attacker reuses that session token directly. No password or MFA needed anymore — to the service, it's simply an already-authenticated, legitimate session continuing.
5
The hidden rule
Once inside the mailbox, the attacker creates an invisible mail rule (e.g. auto-delete or auto-forward emails containing "invoice", "wire transfer", "bank details") to stay hidden from the victim while watching.
6
The bank-details swap
At the right moment — often mid-negotiation or just before a real payment deadline — the attacker sends, from the legitimate mailbox or a near-identical address, "updated bank details" for the next payment.
7
The cash-out
Funds move to a mule account. Gift cards remain, globally, the most-used cash-out method for BEC groups (50% of recorded cases) — fast, hard to trace, impossible to reverse.
Why classic MFA isn't enough anymore
An SMS code or a push notification protects the login moment — not the session that results from it. In an AiTM attack, the victim completes MFA normally: the attacker's invisible proxy faithfully relays that step to the real service, then captures the session token issued right after. The attacker no longer needs a password or a code — they simply replay an already-validated session.
Phishing-resistant MFA (a physical security key, a FIDO2/WebAuthn passkey) changes the game because it doesn't just verify an identity — it also cryptographically verifies the exact domain it's talking to. On a fake domain, however visually perfect, that check fails automatically: the AiTM technique simply doesn't work, no matter how convincing the phishing email is.
What we know — and what we don't
Being honest about the numbers matters as much as citing them:
Origin ≠ victim
Fortra's statistics (36% of attacks from Nigeria) measure the origin of detected attack infrastructure by IP, not where targeted companies are located. Some of these attacks actually target victims in Europe and North America, per INTERPOL.
No isolated regional BEC dataset
No public study currently quantifies, independently, losses specifically due to BEC at West African fintechs. The closest esentry figure measures broader compromised-access fraud, not email-based BEC alone.
INTERPOL's finding is law-enforcement data, not a financial indicator
The "prolific" label comes from law-enforcement data across 36 countries — a real prevalence signal, but not a region-by-region dollar loss figure.
5 habits to defend against it
Phishing-resistant MFA
Move from SMS/push MFA to a physical security key or a FIDO2/WebAuthn passkey. This type of MFA cryptographically binds authentication to the real domain name — an AiTM proxy on a spoofed domain fails automatically, even if the user clicks the link.
Mandatory out-of-band verification
Any change to bank details, even from a known internal address, must be confirmed by calling a number already on file — never the one provided in the email. This is the only defense that still works once the mailbox is already compromised.
Monitor mail rules
A recently created forwarding or auto-delete rule, especially on financial keywords, is one of the most reliable signals of an already-compromised mailbox.
Correctly configured SPF, DKIM, DMARC
These three records prevent a third party from directly spoofing your own domain name when sending email — a distinct but complementary vector to session theft.
Reduce exposure of naming conventions
An attacker who guesses your addresses follow the firstname.lastname@company.com format can precisely target your accountant or CFO without ever having accessed an internal directory.
Two SunuCyberSecurity tools against this vector
Email Security Scanner (SPF/DKIM/DMARC) — checks in seconds whether your domain can be spoofed by a third party, and the real protection level of your DMARC policy. Available from the SunuLight plan.
SunuIdentityWatch — identifies your employees' email addresses already exposed publicly, detects a predictable naming convention (firstname.lastname@), and checks whether those addresses appear in known data breaches. Available with SunuAdvanced and SunuElite.
Sources and methodology
INTERPOL, African Cyberthreat Assessment Report 2026 (law-enforcement data, 36 African countries) · Fortra, BEC Global Insights Report, April 2026 and July 2026 (global data on BEC attack origin) · Nairametrics, coverage of esentry's "Eye of Horus" report, H1 2026 · AiTM mechanism detail via Darktrace and Expel. External figures not published by SunuCyberSecurity unless otherwise noted. Data as of October 22, 2026.
Related articles
Put this into practice
A free scan, in a few minutes, no credit card.
Free scanNewsletter
Get our next analyses
One email whenever we publish a new article. No spam, one-click unsubscribe.