# How should MSPs respond to the FBI email phishing surge?

> Phishing/spoofing is the FBI IC3's #1 crime type by volume; BEC drove $2.77B in 2024 losses. A practical playbook for MSPs to defend client email.

The FBI's Internet Crime Complaint Center (IC3) has ranked phishing and spoofing as the single most-reported crime type two years running — 193,407 complaints in 2024 and 298,878 in 2023, per the FBI IC3 annual reports. For MSPs, that isn't a headline to react to; it's a standing condition to build a service around. Here's what the data actually says and where you can move the needle for clients.

## Quick Takeaways

- Phishing/spoofing is the **#1 IC3 crime type by complaint volume** — 193,407 complaints in 2024, ahead of extortion (86,415) and personal data breach (64,882), per the FBI IC3 2024 report.
- Phishing's *direct* reported loss is comparatively small ($70,013,036 in 2024). The real money is in **Business Email Compromise: $2.77 billion in 2024 losses** from just 21,442 complaints — a phishing-adjacent attack that spoofing enables.
- The controls that address this are the boring, proven ones: **SPF, DKIM, DMARC at `p=reject`, and MFA** — the same stack CISA mandated for federal agencies in BOD 18-01.
- A `p=reject` [DMARC policy](/tools/dmarc) is, in CISA's words, the strongest protection against spoofed email — it tells receiving servers to block messages that fail authentication for your domain.
- Palisade's hosted DMARC lets an MSP take a client from monitoring to `reject` from a dashboard slider, and turns aggregate reports into readable charts instead of raw XML — so enforcement across a portfolio is a repeatable process, not a per-domain research project.

## What does the FBI data actually say about phishing?

Read the IC3 numbers carefully, because the loudest stat isn't the most important one. Phishing/spoofing tops the complaint count every year, but its *directly reported* loss was $70,013,036 in 2024 — a rounding error next to the year's costliest categories. The FBI IC3 2024 report puts total losses across all crime types at $16.6 billion (a 33% jump over 2023), with investment fraud the costliest single type at roughly $6.57 billion and BEC second at about $2.77 billion.

![Comparison of 2024 FBI IC3 figures for phishing/spoofing versus business email compromise, showing phishing leads complaints while BEC leads losses.](/images/figures/mspemailphishingfbireport2024-fig1.webp)
*Figures from the FBI IC3 2024 report: phishing leads complaint volume; BEC drives the losses.*

The takeaway for an MSP: phishing is rarely the crime that empties the account. It's the *entry point*. A credential harvested through a convincing spoofed email becomes the compromised mailbox that a BEC scheme runs through. The IC3 describes BEC exactly this way — an attacker compromises a legitimate business email account, then uses it to redirect payments. And the scale is enormous: the FBI's September 2024 PSA on BEC reported $55,499,915,582 in exposed losses across 305,033 incidents between October 2013 and December 2023, spanning all 50 states and 186 countries. (That's a cumulative decade-plus figure, not a single year — but it shows where spoofing ultimately leads.)

## Which controls actually address this, per CISA and IC3?

CISA and IC3 recommend controls, not products. The clearest blueprint is CISA's Binding Operational Directive 18-01, which required federal agencies to publish SPF records, sign outbound mail with DKIM, and set a DMARC policy of `p=reject`. Three of those work together:

- **SPF** lists the IPs allowed to send for your domain. Check any client's record with the [SPF tool](/tools/spf).
- **DKIM** cryptographically signs outbound mail so receivers can verify it wasn't altered. Verify signing with the [DKIM tool](/tools/dkim).
- **DMARC** ties them together — it tells receiving servers what to do when a message fails both checks: monitor (`p=none`), quarantine, or reject.

CISA calls `p=reject` the strongest protection against spoofed email because unauthenticated messages impersonating the domain get blocked at the mail server before a user ever sees them. On the account side, CISA's MFA campaign frames multi-factor authentication as making an account "99% less likely to get hacked," and points to phishing-resistant MFA (FIDO/WebAuthn) as the strongest form. Treat that 99% as CISA's awareness-campaign framing rather than a precise lab figure — but the direction is not in dispute.

## How should an MSP prioritize across a client base?

Don't boil the ocean. Sequence it:

![Four-step card showing the order MSPs should sequence email defenses, from DMARC enforcement through MFA and mailbox lockdown to training.](/images/figures/mspemailphishingfbireport2024-fig2.webp)
*The sequence from this article; DMARC enforcement is the highest-leverage first move.*

1. **Get every client domain to DMARC enforcement.** This is the highest-leverage move because it structurally kills exact-domain spoofing — the technique behind the spoofing complaints IC3 counts. Start each domain at `p=none` to inventory senders, fix SPF/DKIM alignment, then ramp to quarantine and `reject`.
2. **Enforce MFA everywhere**, and push phishing-resistant MFA (FIDO/WebAuthn) for finance staff and executives — the roles a BEC attacker targets.
3. **Lock down the mailbox mechanics** attackers abuse: restrict external auto-forwarding rules and audit OAuth app grants, which can bypass MFA entirely.
4. **Train against the current pattern** — urgency, spoofed sender names, and payment-change requests — and rehearse a short incident-response playbook: isolate the account, revoke tokens, force a password and MFA reset.

The bottleneck on step 1 is almost always the DNS work. Getting one domain from `none` to `reject` means several record changes over weeks; across fifty client domains, that's where DMARC projects stall for months.

## Where does Palisade fit for an MSP?

Palisade is built for exactly the step-1 bottleneck. With hosted DMARC, the client adds **one CNAME** at `_dmarc.<domain>` delegating to Palisade, and Palisade publishes and maintains the actual record. From then on, policy changes — `none` → quarantine (with a percentage ramp) → `reject` — happen from a dashboard slider with a diff preview before anything is applied. A status badge (Verifying → Active, or Error) tells you where each domain stands.

Just as important for defending against BEC: Palisade parses the DMARC aggregate (`rua`) reports into readable charts in a Reports tab, so you can *see* who's spoofing a client's domain and confirm every legitimate sender passes before you tighten policy — no raw XML. Across a portfolio, that turns enforcement into a batch process instead of fifty separate DNS tickets. Palisade doesn't do the training or the mailbox forensics — but it removes the reason DMARC enforcement usually gets deferred.

## Frequently asked questions

### Is phishing really the biggest email threat if its losses are low?

By complaint volume, yes — it's the #1 IC3 crime type. By dollars, the direct phishing loss was $70M in 2024, while BEC (which spoofing enables) drove about $2.77 billion. Read them together: phishing is the entry point, BEC is the payout.

### Does DMARC stop phishing?

It stops one specific, high-value technique: mail that spoofs *your* exact domain. At `p=reject`, receiving servers block those messages. It won't catch look-alike domains or attacks from a genuinely compromised account — which is why MFA, filtering, and training sit alongside it.

### Is MFA enough on its own?

No. CISA credits MFA with making accounts far harder to compromise, but attackers use MFA-bypass and OAuth-consent abuse. Pair it with phishing-resistant methods (FIDO/WebAuthn), and audit connected app grants regularly.

### How fast can we get a client to DMARC enforcement?

A domain with clean SPF/DKIM alignment can reach `reject` in weeks — the pacing is set by how quickly you confirm every legitimate sender passes at `p=none`. With hosted DMARC, each policy step is a dashboard change, not a DNS ticket, so enforcement day doesn't wait on the client's IT.

### What should we preserve after a suspected mailbox compromise?

Authentication logs, full email headers, mailbox forwarding rules, and OAuth consent grants — plus any DMARC reports showing the spoofing. Those establish timeline and scope before you revoke tokens and reset credentials.

Want a fast read on any client domain? Run the free [Email Security Score](/tools/email-security-score) — it checks DMARC, SPF, and DKIM posture in seconds.

## Related reading

- [DMARC checker](/tools/dmarc)
- [Microsoft compliance checker](/tools/microsoft-compliance-checker)
- [Palisade for Managed Service Providers](/for-managed-service-providers)