BEC Calibration: Why $49,225 Is No Coincidence
The number that only makes sense on second glance
$49,225. At first read, it looks like an odd invoice total or a project flat fee. That is exactly the point.
According to the Cloudforce One Cyber Threat Report 2026, Cloudflare intercepted Business Email Compromise (BEC) attempts totalling $123 million in 2025. The average individual attempt came in at $49,225. Cloudflare explicitly calls this deliberate calibration.
What “deliberate calibration” actually means
Most mid-sized companies and enterprises have internal approval thresholds: wire transfers or payment instructions below a certain amount can be approved by a department head or finance manager acting alone. Above that threshold, a second signatory — often at the executive level — is required.
That threshold frequently sits at $50,000, €50,000, or a similar round number. Attackers know these structures. They deliberately set their fraudulent payment requests just below the limit — at $49,225, a request slips through without triggering a second approver.
This is not speculation. It is a statistically observable pattern drawn from millions of intercepted attempts.
Why email authentication directly addresses this threat
BEC attacks almost always rely on one of two methods:
- Domain spoofing: The sender address looks like
[email protected]but originates from attacker-controlled infrastructure. - Look-alike domains: A domain such as
yourcompany-inc.comoryour-company.comis registered and used for the attack.
DMARC is the most direct countermeasure against domain spoofing. A DMARC policy set to p=reject, combined with correctly configured SPF and DKIM, prevents emails from being delivered in your domain’s name if they do not originate from authorised sending infrastructure.
That sounds technical — but it is precisely the mechanism that stops an attacker from sending an email with the sender address [email protected] to your accounts payable team requesting a $49,000 wire transfer.
What a weak DMARC policy means in practice
Many domains have DMARC configured but left at p=none. That means reports are collected, but spoofed emails are still delivered. For an attacker, it is no obstacle at all.
Common weaknesses that enable BEC:
- DMARC at
p=none— monitoring only, no enforcement - SPF records with too many
includeentries and+allat the end — effectively useless - DKIM missing or configured for only one mail path, not for all sending systems (CRM, ERP, newsletter tools)
Each of these gaps is a potential entry point for exactly the kind of attack Cloudflare describes.
What IT teams should check right now
The technical side can be reviewed in a few steps:
- Which DMARC policy is active —
none,quarantine, orreject? - Are all sending systems covered in the SPF record?
- Is DKIM configured for every outbound mail path?
- Are DMARC aggregate reports being reviewed — or sitting unread in a mailbox?
That last point matters most. DMARC aggregate reports show which servers are sending email on behalf of your domain. Unknown IP addresses in those reports are an early warning signal — before an attacker successfully triggers a payment.
The organisational side
Technology alone is not enough. Organisations with internal approval thresholds should avoid publishing them externally — not in job postings (“you independently approve expenditure up to $50,000”) and not in process documentation that could leak.
It is also worth building payment workflows that require a second-channel confirmation — a phone call, an internal chat message — for unusual requests. Not as a bureaucratic hurdle, but as a quick sanity check.
$49,225 is not a random number. Once you understand that, you look at both approval processes and email authentication with very different eyes.
Check whether your domain is protected against spoofing right now: Free domain check at DMARCPulse