Fortra Report Finds Gift Cards Led BEC Cash-Outs in July 2026
Summary
Fortra's July 2026 BEC report found attack volume fell 12% month over month, while gift cards accounted for 50.2% of cash-out methods. It also documented cryptocurrency scams, wire-transfer requests, and attacker infrastructure trends.
Key points
- Fortra's FIRE team said it gathers intelligence through hundreds of active-defense engagements with BEC actors each month.
- Overall BEC attack volume fell 12% from June; gift cards accounted for 50.2% of July cash-out methods.
- Apple Store cards made up 38.5% of gift-card requests, followed by Amazon at 33.3%.
- FIRE identified 31 cryptocurrency-related scams involving 15 unique Bitcoin wallets.
- The average requested wire-transfer amount was $44,100, down from $71,295 in June; wire-transfer attacks fell 21%.
- Free webmail providers were used for 59% of attacks, compared with 41% from maliciously registered domains.
- The report attributed 62% of attacks to the United States and 18% to Nigeria, while cautioning that IP-based locations are not definitive.
Article Details
- Publisher
- Fortra
- Report Period
- July 2026
- Scope
- Business email compromise (BEC) activity observed through Fortra Intelligence & Research Experts (FIRE) active defense engagements.
- Sample Size
- 823 maliciously registered domains identified in July 2026; FIRE conducts hundreds of engagements monthly.
- Key Statistics
- Overall BEC attack volume decreased 12% in July 2026 compared with June 2026.
- Gift cards accounted for 50.2% of cash-out methods; Apple Store cards made up 38.5% of gift card requests.
- FIRE identified 31 cryptocurrency-related scams involving 15 unique Bitcoin wallets; requests averaged $3,896.12.
- The average requested wire transfer amount was $44,100 in July, down from $71,295 in June.
- Attacks were sent from free webmail providers in 59% of cases and from maliciously registered domains in 41%.
People
Countries
NigeriaGeographic analysis of BEC attacks during July 2026 revealed that United States was the primary source, accounting for 62% of all attacks, followed by Nigeria with 18%.United StatesGeographic analysis of BEC attacks during July 2026 revealed that United States was the primary source, accounting for 62% of all attacks, followed by Nigeria with 18%.