> ## Content Index
> Fetch the complete content index at: https://thecoverwire.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Coalition says AI phishing kits drove a 30% rise in email fraud claims
- URL: https://thecoverwire.com/coalition-ai-phishing-kits-bec-claims-rise/
- Published: 2026-10-16T10:00:00.000Z
- Updated: 2026-11-02T11:34:55.000Z
- Description: The cyber insurer says phishing kits costing $500 a month are making micro businesses worth attacking.
- Author: CoverWire
- Tags: Cyber, #desk-risk

Business email compromise claims at Coalition rose about 30% in the second half of 2025 from a year earlier as AI-assisted phishing made micro businesses cheaper to attack, Insurance Business reported on 16 October.

The cyber insurer expects business email compromise claim frequency to rise by 60% to 100% by 2027\. Its warning matters to brokers and underwriters because the change is concentrated among small firms that were previously less attractive to fraudsters.

The briefing draws on anonymised claims from Coalition's global portfolio of more than 110,000 policyholders. It is not a UK-only dataset.

Coalition pointed to EvilTokens, a subscription phishing kit linked to the compromise of more than 12,000 inboxes at more than 10,000 organisations. The kit uses AI to write phishing emails, bypass multi-factor authentication, set mailbox rules and scan inboxes for sensitive information.

Access costs $1,500 upfront and $500 a month. Coalition said these tools have made micro businesses, which "weren't previously worth the effort", viable targets.

Coalition does not expect business email compromise frequency to more than double. The average claim is typically below $30,000.

Funds transfer fraud is Coalition's second most common claim type, with average severity of $140,000\. Its frequency fell 18% in 2025, but Coalition expects a rise of 20% to 50% over the next year.

Those losses are covered under cyber and crime policies, typically with a sublimit of about $250,000\. Coalition warned that limits on each loss will not protect insurers if the number of frauds rises sharply.

Its overall claims frequency has held between 1.4% and 1.6% since 2022, and it has seen no evidence yet that AI has lifted ransomware frequency.

The UK Cyber Security Breaches Survey for 2025 and 2026 found that 42% of micro businesses had reported a breach or attack in the previous 12 months. Coalition said brokers could use the rising risk "to open conversations with non-buyers in the SMB segment".

Coalition's recommended control is simple: call back on a trusted number before changing payment details, with dual sign-off.

Related coverage: [Brit adds cyber to Acturis Package for brokers at commercial renewal](https://thecoverwire.com/brit-cyber-launches-on-acturis-package/) and [Old Mutual says provider error may have exposed customer phone numbers](https://thecoverwire.com/old-mutual-provider-configuration-error-customer-data/).

## Sources

- [Insurance Business: AI phishing kits are making micro businesses worth attacking, Coalition warns](https://www.insurancebusinessmag.com/uk/news/cyber/ai-phishing-kits-are-making-micro-businesses-worth-attacking-coalition-warns-593811.aspx?ref=thecoverwire.com)
- [Risk & Insurance: Business email compromise claims jump 30% as AI reshapes cyber risk](https://riskandinsurance.com/business-email-compromise-claims-jump-30-as-a-i-reshapes-cyber-risk/?ref=thecoverwire.com)
- [Microsoft Security: Unmasking EvilTokens](https://www.microsoft.com/en-us/security/blog/2026/09/22/unmasking-eviltokens-getting-to-the-root-of-device-code-phishing/?ref=thecoverwire.com)