Business email compromise (BEC) scams have cost Malaysian organisations over RM7.5 million between 2023 and the first half of 2025, according to cybersecurity firm Kaspersky, highlighting a growing and sophisticated threat that continues to bypass traditional defences.
Kaspersky shared that often beginning with phishing attempts to steal login credentials, BEC attacks manipulate human trust rather than exploit technical flaws.
“The scams typically involve cybercriminals impersonating senior executives or trusted vendors in emails that appear legitimate but are crafted to deceive recipients into transferring funds or disclosing sensitive data,” the cybersecurity firm said.
The firm revealed that its Cyber Incident Quarterly Report for the first quarter of 2025 recorded six BEC cases reported to Malaysia’s Cyber999 Response Centre, twice the number reported in the previous quarter.
“Reported losses per case ranged from RM250,000 to RM6.2 million, with affected victims spanning logistics, manufacturing and retail sectors,” it said
It added that the firm also recorded 64,778 phishing attempts against Malaysian companies in 2024 alone, averaging over 5,300 per month, placing the country third in Southeast Asia behind Thailand and Indonesia.
“The real danger of BEC scams lies in their simplicity. These attacks are well-timed and exploit routine communication and human error, which is why many still fall for them,” Kaspersky Managing Director for Asia Pacific Adrian Hia said.
To mitigate the threat, Hia urges businesses to adopt stronger cybersecurity habits, including the use of two-factor authentication, specialised anti-BEC tools, regular employee training and verifying unusual requests through alternative communication channels.
As cybercriminals evolve, Hia emphasised that protection must move beyond detection, “It’s about anticipating threats and helping businesses spot the unusual in what seems normal”.
Source: https://www.businesstoday.com.my/2025/07/07/business-email-compromise-costs-malaysia-rm7-5-million-in-the-past-2-years/