Cyber insurer Coalition says claims for business email compromise have risen by roughly 30% and links the rise to cheap, AI-driven phishing kits that make even the smallest firms profitable targets. For UK micro businesses, many of which hold no cyber cover, the message is that being small is no longer a defence.
What happened
Coalition, the cyber insurer, has published a Risk Intelligence Briefing on how artificial intelligence is changing the claims it pays. Insurance Business UK (16 October 2026) and Risk & Insurance (15 October) reported the main findings. The briefing draws on anonymised claims from more than 110,000 policyholders worldwide, so it reflects Coalition’s own book rather than the UK market specifically.
The headline figure, according to both outlets, is a rise of about 30% in the frequency of business email compromise (BEC) claims. Insurance Business UK reports that figure as a comparison between the second half of 2025 and the same period a year earlier, and says the trend has continued into 2026. Coalition looks for the cause in the economics of phishing tooling, and says the effect is landing hardest on micro businesses that criminals previously ignored. As Insurance Business UK reports it, those firms “weren’t previously worth the effort”.
Coalition’s forecast is blunt. Insurance Business UK reports the insurer expects BEC claim frequency to climb between 60% and 100% by 2027. Both outlets add that Coalition does not expect the rise to go beyond 100%, because takedowns of criminal infrastructure and the practical difficulty of recruiting money mules still limit how fast attackers can cash out.
The detail
The clearest example in the briefing is EvilTokens, a phishing kit sold as a subscription service. Both outlets report Coalition’s figures: the kit has been used to compromise more than 12,000 mailboxes at over 10,000 organisations, and it costs US$1,500 to start plus US$500 a month. According to Coalition, as reported, the platform uses AI to write lures, get past multi-factor authentication (MFA), avoid detection and search compromised inboxes for useful material.
That price point is what changes the targeting. When a criminal pays a flat monthly fee for a tool that does most of the work, redirecting a single modest invoice at a small firm becomes worth the effort. Coalition puts the average BEC loss below US$30,000, a figure both outlets report. Risk & Insurance notes Coalition also cited a US$30 million claim documented by NetDiligence.
Funds transfer fraud, in which a business is tricked into paying criminals directly, is the more expensive problem. Insurance Business UK reports it is Coalition’s second most frequent claim type, with an average claim of US$140,000. Claim frequency dropped by 18% during 2025. Coalition nonetheless predicts growth of between a fifth and a half within twelve months, once automated BEC kits learn to identify upcoming payments and draft persuasive requests to divert them. Coalition also expects deepfake-enabled fraud to grow by 20% to 50% by 2027, according to Risk & Insurance, though most fraudulent transfers still begin with an email.
The briefing does not claim AI is changing everything at once. Risk & Insurance reports that Coalition has seen no year-on-year change in ransomware claim frequency and expects the human-led stages of ransomware operations to stay largely manual for 12 to 36 months. Coalition’s overall claims frequency has sat in a narrow 1.4% to 1.6% band since 2022, Insurance Business UK reports.
Why it matters for UK organisations
The UK data points the same way. Insurance Business UK cites the government’s Cyber Security Breaches Survey 2025/26, in which 42% of micro businesses said they had suffered a breach or attack during the past year. Phishing was the type they reported most often. The same survey found 47% of UK businesses held cyber insurance “in some form”, but that figure includes cover bundled into wider commercial policies, where limits and triggers can differ sharply from a dedicated cyber wording.
The standalone picture is thinner. In separate reporting, Insurance Business UK quotes CFC’s Lindsey Maher putting SME cyber penetration in the UK at roughly 10% to 15%, against 30% to 40% in the US. The outlet also cites Markel UK research that found 44% of the SMEs it surveyed had no cyber cover, with close to 40% of the uninsured group believing an attack was unlikely.
Put those numbers together and the exposure is obvious: many of the businesses now in range of subscription phishing tools have neither the controls nor the insurance to absorb a payment fraud. Insured firms should check their sublimits too: Coalition notes, as reported by Insurance Business UK, that funds transfer cover is typically sublimited at about US$250,000.
Expert view
None of this surprises anyone who tests Microsoft 365 tenants. The weak points behind most BEC cases are rarely exotic: legacy authentication left switched on, MFA based on push approvals or SMS codes that a proxy kit can relay in real time, and no alerting on new inbox forwarding or hiding rules. In my experience, small organisations often believe that turning on MFA closed the door. Adversary-in-the-middle kits were built to walk straight through that assumption by stealing the session token rather than the password.
What Coalition’s data adds is commercial evidence that the economics have moved. When a criminal tool is sold like a SaaS product with a monthly subscription, the criminal’s return on each victim matters much less. That model rewards volume, and firms that relied on being too small are now just another row on a target list.
I would not read the flat ransomware figures as good news. They describe one insurer’s book over a short period. The sensible reading is that email fraud is where AI-assisted crime already pays, so that is where controls and cover should tighten first.
What to do now
- Harden payment processes first. Require a call-back to a known, trusted phone number (never one taken from the email) for any new payee or change of bank details, with dual sign-off for payments above an agreed threshold. Coalition recommends exactly this, and it costs nothing.
- Move to phishing-resistant MFA. Passkeys or FIDO2 security keys for finance staff, directors and administrators defeat real-time relay attacks. Block device code sign-in where it is not needed. This maps to the Cyber Essentials user access control requirements.
- Close legacy and risky sign-in paths. Disable legacy authentication, apply conditional access where your licensing allows, and restrict who can approve third-party app consent. These fall under Cyber Essentials secure configuration.
- Watch the mailbox. Alert on new inbox rules, external forwarding and sign-ins from unusual locations or hosting providers. These are cheap signals that catch most BEC intrusions early.
- Read your policy wording. Ask your broker whether social engineering and funds transfer fraud are covered, under which policy, and up to what sublimit.
Bottom line
Coalition’s claims data is one insurer’s view, but it lines up with what UK surveys already show: phishing is the attack small firms see most, and too few of them are insured against it. Cheap AI kits have removed the effort that used to protect micro businesses. The fixes are mostly procedural and inexpensive, and they are worth making before the next fake invoice lands.
Sources
- Insurance Business UK: AI phishing kits are making micro businesses worth attacking, Coalition warns
- Risk & Insurance: Business Email Compromise Claims Jump 30% as A.I. Reshapes Cyber Risk
- Coalition: Risk Intelligence Briefing: How AI is Impacting Cyber Risks
- Insurance Business UK: SME cyber insurance uptake stalls everywhere except the US
