The email is genuine. The request inside it is not.

One root, many frauds

Every fraud below works the same way: someone impersonates a trusted party to trigger an action, a payment, a change of details, the acceptance of a document. They are one problem wearing different clothes.

$55bn+

Total reported losses from business email fraud, October 2013 – December 2023, as counted by the FBI’s complaint centre (IC3). Their figure counts both money lost and money nearly lost.

Source: FBI IC3, “Business Email Compromise: The $55 Billion Scam”, 11 September 2024, ic3.gov/PSA/2024/PSA240911. Verified 3 September 2026.

Exact figure: $55,499,915,582 across 305,033 incidents.

A measure of the pain, not of a market. We size the market from real buyers, never from a headline.

One shape behind all of them

Nine situations, one shape: the channel is authentic and the instruction inside is not the organisation’s. Each card says what can be established TODAY — and each of those answers is bounded by the same fact: the questions are built, and no organisation is enrolled.

Nine names, one question

Open the situation you are in.

An urgent, confidential transfer ordered by someone who writes exactly like your CFO.
A real supplier relationship, a payment quietly redirected elsewhere.
The narrow, high-value case we start from, the easiest to explain and the fastest to prove.
Plausible documents, correct amounts, the wrong account.
A signature that looks right on a document nobody authorised.
Money diverted at the exact moment a property sale pays out.
An employee’s salary account changed by someone who is not the employee.
A fraudster gets a false change of director recorded at the business registry. He obtains an official extract in his own name, presents himself to the bank as the new manager, and has the bank details changed or orders transfers. The banker sees a document in good order; nothing, on paper, contradicts it.
The same move, another counter. The fraudster has himself recorded as manager of a company that holds a property, then sells the property in front of a notary who also sees an official extract in good order.

What settles all of them

The same question settles all of them, and it has a clear yes-or-no answer, not a matter of opinion.

When the channel is a live call

Someone calls — your bank, a director, head office — and asks you to act in the minute: move money, change bank details, approve an exception. A voice cannot be sealed. So the answer is not to seal the call; it is to make the caller prove, in that same minute, who they are.

During the call, the real party sends you a sealed proof — a link you open in seconds, with no account — that reads: your contact is this person, this role, of this organisation; the organisation vouches for them; they have just made a request concerning you, with the moment and a fresh element tied to this exchange. A stranger holds neither the organisation’s key nor an enrolled device, so the proof does not come. No valid proof means it is not them — ask for it every time.

What Atestan does not do here. It does not seal a voice, and it does not move onto the payment rails to stop a transfer. It makes a request made over a live channel verifiable, and it lets the real organisation set one habit: a genuine instruction always arrives with its proof; no proof, not us.

The phone check that goes with the proof

For bank-detail changes above all: call the supplier on a number you already had, never the number in the request, and confirm one detail with the spoken code. The code reveals nothing by itself; it confirms, it does not give anything away.

CEO fraud, supplier impersonation, a redirected payroll, a property sale diverted at the last minute: the attacker’s job is always the same, make a request nobody approved look ordinary. And the question that exposes it never changes: what evidence is there for this request?