Andrew Rose is a BioAg advisor to The Bioeconomy Information Sharing and Analysis Center (BIO-ISAC), a nonprofit building cybersecurity resilience within the life sciences, biotech, and broader bioeconomy.
The views expressed in this article are the author’s own and do not necessarily represent those of AgFunderNews.
Recently, a senior agriculture executive discovered that an email sent from their account was part of a phishing attack. It wasn’t a sophisticated email, but it came from someone with a high level of trust in the community and people clicked.
Unfortunately, the executive decided to go dark and not comment about the incident. Threat response firm Invictus Incident Response (prompted by the BIO-ISAC) finally lifted the hood to decipher intent. (Read the full Invictus report here.)
In another recent situation, a bioscience leader immediately spoke to BIO-ISAC when they were alerted that their email account had been taken over. Thanks to this early response, they were able to take back control of the account, assess damage, and craft a response in just hours.
“The infrastructure behind modern phishing may be getting more sophisticated, but defenders aren’t powerless,” says Invictus managing partner Curtis Hanson. “Attackers can borrow trust and disguise the path to the login page, but phishing-resistant authentication and strong identity controls can stop that trust from turning into access.”
In agriculture, it pays to be prepared, not scared. The best time to understand how this theft of trust is used for nefarious purposes is before the incident occurs. Learning how to respond and the smart steps to take are essential for the world we are in.
The FBI describes business email compromise (BEC) as one of the most financially damaging online crimes. In a typical BEC attack, criminals impersonate a known individual or compromise a legitimate business email account and use it to request money, sensitive information, or other actions.
According to the FBI’s 2025 Internet Crime Complaint Center (IC3) Annual Report, 24,768 BEC complaints were reported in 2025, representing more than $3 billion in reported losses. BEC was the second-largest cybercrime category by reported financial loss, behind investment fraud.
This is roughly a 10% year over year increase.
The FBI recorded over 1 million complaints and $20.8 billion in total reported internet-crime losses in 2025, with losses increasing 26% from the previous year.
Cyber-enabled fraud alone accounted for $17.6 billion, or approximately 85% of all losses reported to IC3.
In 2025, 22,364 complaints were identified as AI-related, associated with $893.3 million in reported losses.
And these are just the reported losses.
How BEC works
In BEC attacks, amateurs can create AI-generated impersonations of leaders with tools that are mostly free or low cost. Threat attackers use armies of AI agents to synthesize publicly available information to understand:
- Who the CEO works with
- Who approves payments
- Which vendors the company uses
- What projects are underway
- Where executives are speaking
- Which conferences they attend
- Who their business partners are
- How a particular executive writes and communicates
- AI tools twist this information into action
The result may be an email (or video) that is grammatically correct, appropriately written or spoken, highly personalized, and consistent with the executive’s normal communication style.
Steps to protect
This is where “spidey sense” comes into the equation: a small pause that asks, “Does this request make sense?” This pause has saved organizations millions. Attackers only need to convince one person that a message is real.
Multifactor authentication (MFA) is an important defense. Cybersecurity and Infrastructure Security Agency (CISA) recommends organizations use MFA broadly, and specifically encourages phishing-resistant methods. There is a difference between this and traditional methods such as SMS codes or some one-time passcodes, which can still be defeated through social engineering.
As Hanson notes, wise organizations use passkeys and other phishing-resistant authentication mechanisms. CISA specifically identifies phishing-resistant MFA as the preferred approach for protecting accounts, particularly email, remote access, and other high-value services. For executives, researchers, financial personnel, administrators, comms, and others with privileged access, this needs to be a priority
Another level of protection is an established (and followed) set of rules for transactions and sensitive requests:
- Changing a bank account? Verify by phone.
- Sending a large payment? Verify through a second channel.
- Changing a vendor’s payment instructions? Require independent confirmation.
- Requesting sensitive information? Verify the requester’s identity.
- An executive asks for something unusual? Pick up the phone.
The FBI specifically recommends using secondary channels to verify requests involving changes to account information. The objective is to make it difficult for the attacker to control both sides of the conversation.
Prepare for the inevitable: a recommended format
The reality is that eventually, someone in your organization will click. This is as true for large agribusinesses as it is for small farming operations, and both groups need to know what happens next.
Employees should know exactly whom to contact and should not be afraid to report a mistake.
A basic response process could include:
1. Stop interacting with the suspicious message.
2. Notify IT/security immediately.
3. Determine whether your credentials were entered or if the email address was spoofed.
4. Secure the affected account. Add MFA and passkey to the email account.
5. Look for suspicious inbox rules, forwarding, or other persistence mechanisms.
6. Determine whether other employees or external partners received fraudulent messages.
7. Contact financial institutions immediately if money was transferred.
8. Preserve emails, headers, links, and other evidence.
9. Report the incident to appropriate law enforcement when appropriate.
Speed matters when money has been transferred. Organizations should immediately contact their financial institution and request a recall, and file an IC3 complaint as quickly as possible.
A sample response email:
The following email is in the format BIO-ISAC recommended for the bioscience CEO mentioned at the start of this article. In general, this format works for most BEC incidences.
Hello all,
Thank you to everyone that swiftly messaged me when they noticed a suspicious email from my account. I appreciate how quickly you responded.
We have confirmed that this was a phishing attack, and I have worked with cybersecurity professionals to secure the account and assess any potential impact.
You are receiving this email because you were included in the fraud attack.
What you should do now:
- Do not click any links or attachments from the earlier message.
- If you opened the link, please contact your IT or cybersecurity team immediately.
- If you entered your login information, change your passwords right away and notify your IT/security team.
- If you processed payment at the URL, it is extremely urgent that you contact your bank asap to let them know. Next, please file a complaint at ic3.gov.
- This site has the ability to freeze transactions reported within 72 hours. We take this situation seriously and are continuing to watch for related activity.
My apologies for any inconvenience.
Thank you again for your quick action.
