Security awareness training teaches people to spot the sketchy link.
The most expensive email attack usually doesn't have one.
BEC is just an email. A vendor "updating" their bank details. An exec who "needs this wired today." No malware, no payload, nothing for a sandbox to detonate.
The FBI's 2025 report puts BEC as the second costliest crime type it tracks, at just over $3 billion. Verizon's 2024 DBIR found pretexting, most of which ended in BEC, made up about a quarter of financially motivated attacks.
You can't train your way out of a perfectly normal-looking email. You investigate the context around it: who's really sending, from where, whether the reply-to quietly changed, and whether the account itself is compromised.
No link doesn't mean no threat. Usually it means a smarter one.