BEC ‘Are you at your desk?’ Lures Surge in Q2

How the Attack Worked

According to Microsoft's Q2 2026 threat data, business email compromise (BEC) campaigns rarely lead with a financial request. Instead, most begin with a short, vague message such as "Are you at your desk?" These generic conversation starters made up 87 to 92 percent of initial contact emails each month during the quarter. Once a target replies, the attacker uses the established rapport to move toward a fraudulent ask, such as a wire transfer or document request, later in the exchange.

Alongside this, Microsoft tracked roughly 7.6 billion email-based phishing threats in Q2, with credential phishing as the dominant objective. Attackers also leaned on QR codes embedded in PDF and DOC/DOCX attachments to route victims to fake login pages, and increasingly used calendar invitations (ICS files) that can inject malicious links directly into a user's calendar without requiring a click on the invite itself.

Why It Succeeded

Each of these methods works by lowering a target's guard:

• A vague opener like "Are you at your desk?" contains no clear ask, so it doesn't trigger the skepticism a direct financial request might.
• QR codes shift the interaction to a mobile device, often outside the reach of corporate email security tooling.
• Calendar invites are processed differently than standard attachments, so a malicious link can land in a user's calendar without an obvious open-and-click step.
• Teams-based social engineering, including voice phishing, exploits the assumption that internal collaboration tools are inherently more trustworthy than email.

What to Watch For

• Unsolicited messages that open with small talk or vague questions and push for a reply before stating a purpose.
• Attachments, PDF or DOC/DOCX, that ask you to scan a QR code to sign in.
• Unexpected calendar invites, especially ones with unfamiliar join or sign-in links, that arrive without prior discussion.
• Unusual voice calls or Teams messages requesting sensitive actions, particularly from unfamiliar internal-looking contacts.

Building Resistance

Finance, executive assistant, HR, and procurement staff are common BEC targets because they can action payment or document requests. Employees across all roles should treat generic, out-of-context opening messages as a potential early-stage BEC attempt and verify the sender through a separate, known channel before continuing the conversation. Security awareness efforts should also expand beyond email to cover Teams messages, voice calls, and calendar invites, since these channels can feel more trusted to users and are increasingly used to carry out the same underlying credential theft and fraud objectives Microsoft observed in email traffic. See MITRE ATT&CK technique T1566 for background on phishing delivery methods referenced in this report.

Why do BEC scams open with 'Are you at your desk?'

Microsoft found generic conversation-starter emails like this accounted for 87 to 92 percent of initial contact emails each month, as attackers build rapport before making a fraudulent request rather than asking for money upfront.

How are QR codes being used in phishing attacks?

QR codes are increasingly delivered inside PDF or DOC/DOCX attachments, leading victims to credential-stealing login pages rather than requiring a malicious download.

Can a calendar invite alone be dangerous?

Yes. ICS calendar invitations can inject malicious links into a user's calendar without requiring an explicit open-and-click interaction, and this technique nearly quadrupled in June.

Is phishing moving beyond email?

Microsoft observed continued growth in Teams-based social engineering, including voice phishing, since these channels can appear more trustworthy to users than email.