Coalition Finds AI Lifted BEC Claims 30% While Funds Transfer Fraud Fell 18% and Ransomware Did Not Move

Business email compromise is where AI has reached Coalition's claims so far: frequency rose from 0.40% of policies in the second half of 2024 to 0.52% in the second half of 2025, a 30% increase the briefing ties to subscription phishing kits that automate multi-factor authentication bypass (Coalition, October 2026). Funds transfer fraud went the other way, down 18% in 2025, and ransomware frequency did not change.

The briefing, titled How AI Impacts Cyber Risk, is built on anonymized claims across more than 110,000 policyholders and was released in mid-October. Its usefulness to a pricing actuary is the decomposition: the line AI has already moved is the one with an average loss under $30,000, and the lines that carry cyber loss cost have not moved yet.

Key Takeaways

1.55% total claims frequency in 2025, after 1.43%, 1.41% and 1.50% in 2022 to 2024, against a 40% market-wide frequency increase the NAIC reported for 2024 and 34% and 55% spikes at Chubb and Marsh in the same year.
0.52% BEC frequency in H2 2025 compares with 0.34% in H1 2023; the briefing attributes the late-2025 jump to kits such as EvilTokens, sold for $1,500 plus $500 a month and linked to 12,000 compromised inboxes across 10,000 organizations.
$140,000 average FTF severity against under $30,000 for BEC means a 50% FTF frequency rise adds more loss cost than a doubling of BEC, on Coalition's own 2025 frequencies.
Three times as many exploitable vulnerabilities were flagged by Coalition's threat team in August and September 2026 (87 and 80 alerts) as in March (26), with no corresponding move in ransomware claims frequency, which ran 0.33% in H2 2025 against 0.32% a year earlier.
150 privacy claims from one plaintiff doubled privacy claim frequency among Coalition policyholders in H1 2026 before a California federal court declared him a vexatious litigant in July, a pattern the briefing expects to reach employment practices liability.

Three Claim Types, Three Different Answers

Coalition's aggregate frequency series is the first exhibit and the quietest. Frequency spiked 39% to 2.09% in 2020 and reached 2.39% in 2021, then fell 40% in 2022 when the Conti group's internal disputes disrupted ransomware operations, and has held between 1.41% and 1.55% since. Against that sits the market: the NAIC's 2025 report on the cyber insurance market put 2024 frequency up 40%, Chubb saw 34% and Marsh 55%, and for 2025 Chubb reported US small and mid-sized business frequency up a further 15% while Marsh's claims fell about 30% (Coalition, October 2026, citing each source).

Inside the book, the types diverge. BEC frequency by half-year ran 0.34%, 0.36%, 0.43%, 0.40%, 0.42% and 0.52% from H1 2023 to H2 2025. The briefing rejects the obvious earlier explanation, GPT-2 and GPT-3 arriving before the 67% BEC spike of 2020, on the ground that OpenAI's own GPT-4 evaluation found the model "not a ready-made upgrade to current social engineering capabilities," and attributes the 2020 jump to pandemic workflows. The late-2025 move it does attribute to AI, because agentic kits now run the full pipeline: fake login page, credential use, mailbox rules to evade detection, and keyword search of the inbox for "wire transfer."

Funds transfer fraud, the second most common claim type, fell from 0.54% in H1 2024 to 0.41% in H2 2025 after two years at 0.51%, and deepfakes remain rare in FTF claims. Ransomware ran 0.31%, 0.29%, 0.28%, 0.35%, 0.32% and 0.33% across the same six half-years. The one ransomware signal in the briefing is upstream of claims: Coalition's count of potential zero-day alerts on perimeter, no-interaction, remote-code-execution vulnerabilities rose from 26 in March to 87 in August 2026, which it dates to the Project Glasswing model releases.

Frequency Times Severity, by Line, Against the Forecast

Coalition's forecasts are frequency forecasts: BEC up 60% to 100% by 2027 but, in Coalition's view, no more than 100% because infrastructure takedowns and the supply of money mules bottleneck attackers; FTF up 20% to 50% within a year as the same kits learn to spot impending payments; ransomware initial access automated while full network compromise against high-value targets stays manual for 12 to 36 months.

Put the briefing's own severities beside them and the loss-cost ranking inverts. BEC at 0.52% frequency and under $30,000 average loss is roughly $156 of annual loss cost per policy; doubling it adds about $156. FTF at 0.41% and $140,000 is about $574 per policy; a 50% rise adds about $287.

Ransomware is the line that sets cyber rate adequacy, and the briefing gives it no severity figure, only the NetDiligence finding that it represented 75% of all claims paid by the industry in 2025. A frequency series flat at 0.3% on three quarters of paid loss is the reason Coalition's total frequency has not moved, and the reason the market could cut rates for twelve straight quarters, as actuary.info reported in July, without the loss ratio responding. AI reaching BEC first is AI reaching the line a 2025 cyber rate filing can absorb inside its expense load.

The FTF forecast is the one with a coverage consequence. The briefing notes that both cyber and crime forms cover these losses, "typically up to a sublimit of $250k," and that "sublimits do not protect insurers if AI scales up the frequency of fraud." A sublimit caps severity per claim; the forecast is about count. The worked deepfake case in the briefing, a Teams video impersonation of a parent-company CEO that ended with $190,000 wired to Hong Kong, sat inside a typical sublimit and still ran to 1.4 times the line's average severity. Chubb's 2026 claims report showed the same shape at the large-account end, severity doubling while frequency fell.

The Book That Reports the Calm Is Built to Be Calm

Coalition says so itself, in a section headed "Challenges Interpreting Claims Data." Policyholders have to pass its underwriting, riskier technologies are priced up until they leave the portfolio, and policyholders receive security tools as a policy benefit, including a Login Security service offered free that monitors Microsoft 365 and Google Workspace logins. On ransomware it goes further: the vulnerabilities surging since Project Glasswing "affect technologies that have historically been associated with elevated claims," and Coalition "has either declined applicants deploying the riskiest technologies, or asked them to implement compensating controls," so "increased risk of ransomware may be visible outside our customer base."

That is a selection statement, and it cuts both ways for anyone pricing off the exhibit. The 1.55% aggregate and the flat 0.33% ransomware line describe a curated book, which is why the NAIC's 40% market increase and Coalition's 7% can both be true of 2024. An actuary benchmarking a less selected portfolio against these figures is benchmarking against a book whose underwriting was designed to produce them, and the briefing's forecast of automated ransomware concentrating in "micro businesses not worth a human operator's time" lands on exactly the segment, under 5% of US businesses buying cyber at all, that the admitted market has never priced.

A final exhibit extends the problem past cyber. One self-represented plaintiff, Vivek Shah, generated more than 150 privacy claims among Coalition policyholders in a year and doubled H1 2026 privacy frequency before being declared vexatious in July; the briefing cannot confirm AI was involved but calls the scale "suggestive," and expects the economics, where AI collapses the cost of filing while the cost of defense stays fixed, to reach employment practices liability next. The line AI moved first in cyber had an average loss under $30,000. The one it moves in liability will be priced on defense cost, where there is no sublimit.

Coalition Finds AI Lifted BEC Claims 30% While Funds Transfer Fraud Fell 18% and Ransomware Did Not Move

Key Takeaways

Three Claim Types, Three Different Answers

Frequency Times Severity, by Line, Against the Forecast

The Book That Reports the Calm Is Built to Be Calm

Further Reading

Sources