How to Protect Your Business from CEO Impersonation Scams

What is CEO fraud, and why is it so dangerous in the context of cyber security? Otherwise known as a CEO impersonation scam, CEO fraud is a type of cyber crime that is fast becoming one of the most costly forms of business email compromise (BEC) for organizations. The FBI’s Internet Crime Complaint Center (IC3) reported $2.9 billion in losses just from BEC scams, including CEO fraud, in 2023.

Why are BEC and CEO fraud attacks successful? Perpetrators abuse trust and authority to masquerade as senior company officers and deceive employees into sending money, revealing sensitive files, or authorizing fraudulent transactions, often focusing on specific CEO fraud targets. And for entrepreneurs, getting suckered in by an impersonation of their company’s top executives through an urgent request isn’t just a matter of money.

What is CEO fraud? Statistics and more

The definition of CEO fraud

CEO fraud is a cybercrime in which attackers pose as company executives. They typically impersonate the highest-ranking company executives. This is done to trick employees, sometimes multiple times at each target business, into conducting fraudulent activity. It is a subcategory of the larger phenomenon known as Business Email Compromise (BEC).

What is another name for CEO fraud? Executive phishing vs whaling

CEO fraud is also often referred to as executive phishing and whaling. While the two terms are closely related, they are not the same:

Executive phishing: This is a general term for any sort of phishing attack in which the attacker pretends to be an executive or employee to deceive their target.

Whaling: Is a targeted phishing scam aimed at high-ranking executives in organisations. Scammers focus their efforts on hitting the big fish in companies.

The CEO fraud meaning overlaps with both. That might involve phishing tactics through fake emails containing malicious links or whaling attacks directly targeting a company’s director. The major difference between the two types of attack is that CEO fraud schemes do not target the executives, but instead impersonate them to defraud employees.

How does CEO fraud work?

CEO fraud or impersonation is more than just a single technique. It forms part of an elaborate scam. Attackers do their homework on a company. They go through its website, social media, and news releases. CEO fraud scammers then collect names, roles, and writing styles of executives.

Scammers then craft convincing CEO fraud emails from this information. The message behind the phishing emails is one of urgency and often secrecy. Enticing victims not to tell anyone about the transaction or communication. The messages drive employees not to fact-check.

CEO fraud victims may also be subject to unauthorized transactions, deposit money, disclose private information and other sensitive data, or adjust payroll information. When the fraud is discovered, it’s usually too late to recover lost funds, highlighting the importance of knowing how to report CEO fraud.

The main targets of CEO fraud attacks

Not all employees are equally exposed. In CEO fraud, con artists usually target departments or positions that deal with payroll, financial transactions, privileged data, or confidential information. 

Finance department

Attackers request immediate unauthorized wire transfers, phony invoice payments, or modifications to vendor bank details. Because finance personnel are accustomed to handling these types of requests, it can be easy for a fraudulent request to hide in the noise of day-to-day business.

Human resources

Employees in the HR department can also become victims of data theft. Fraudsters might pretend to be a company’s executives and ask for staff tax records, payslips, or personal details.

IT department

A spoofed email from a top executive might request that IT workers reset passwords. This will provide attackers with no-questions-asked access to corporate networks.

Executive team

In some cases, the CEO fraud scams arrive masquerading as messages from a legitimate partner, board member, or government official.

The 8 most used attack methods

Here are some of the most popular and dangerous tactics employed by CEO fraudsters:

Generic phishing attacks

Phishing is typically used by scammers who want to deceive a large group of victims into clicking on something malicious or opening an attachment, often leading to a successful CEO fraud attack. Phishing is a less targeted attack, but it can result in the placement of malware on a victim’s computer.

Spear phishing techniques

Spear phishing is targeted. CEO fraud attackers will scope out an organization and write very convincing spoof emails to one or a small number of people, typically working in finance or HR.

Voice cloning (deepfake audio)

AI breakthroughs enable fraudsters to produce near-real audio snippets in an executive’s voice. The scammers use those clips in urgent phone calls to instruct the staff to transfer money or update vendor information.

Email spoofing & lookalike domains

Spoofing is a technique used to make a fake email address appear to be a trusted. Attackers can also create domains that are visually similar to a company’s true domain (for example, using “trmstracer[. com” instead of “trustracer[.] com”) to fool recipients. CEO fraud emails often use spoofing.

Executive whaling

Whaling targets high-level executives and board members, and can often be categorized under CEO fraud phishing. It relies on social engineering to dupe senior staff in accounts payable and even colleagues. The CEO fraud scam might entice a CFO to authorize large wire transfers or modify payment instructions.

Social engineering techniques (non-email)

Attackers leverage information from LinkedIn, company websites, conferences, and press releases to develop plausible situations. They might call on a staff phone to establish urgency and trust before committing the crime.

Virtual conference impersonation

Scammers hijack video conferences, impersonating a director, investor, or partner. They exploit the trust and immediacy of an in-person meeting to solicit information or tell someone to send money.

Smishing (SMS phishing)

Smishing is a CEO fraud scam that sends text messages to fool the recipient into clicking on a link or giving permission for something. A quick, urgent SMS “from the top executive” can bypass email controls and pressure employees to act without confirming on formal channels.

Is it possible for hackers to spoof one of my own domain email addresses?

The short answer is yes. CEO scam attacks can “spoof” the sender of an email to make it look like it is from your domain using two main principles:

• Display-name spoofing: The email client displays an impersonated name, such as [email protected], while the actual sender is another. Some users fail to check the headers and believe the email originates from the actual CEO.
• Compromised/fraudulent accounts and lookalike domains: The attackers either compromise a real internal account (via captured credentials) or register an almost-identical domain (typosquatting) and configure email aliases there. These doppelgänger domains stand a better chance of passing even the most clued-up employees.

Common attack scenarios

Here are some common CEO impersonation fraud scenarios used by attackers. They’re crisp and practical, so employees and managers can identify the pattern.

Scenario 1: Urgent wire-transfer request

An email (or text) arrives from “CEO,” asking the company’s finance team to urgently pay a new vendor. It would emphasize that the need for secrecy is important and bypasses normal approval levels.

Scenario 2: Vendor updated

The fraudster emails the accounts department of a company, pretending to be an authorised supplier. They go on to ask for payment into a different bank account.

Scenario 3: Payroll diversion

An email that purports to be from an “executive” asks that HR update payroll bank details for one or more employees. Then the wages are redirected to attacker accounts.

Scenario 4: Invoice-priority scam

Thieves hack a supplier’s email and send realistic-looking invoices to dozens of customers. Payments are then routed to a fraudster.

Scenario 5: Data request ’due diligence’

An attacker posing as an investor or partner requests access to employee databases, tax forms, or sensitive contracts. All these things can be used to exploit identity theft or to follow up with other attacks.

How to detect and prevent CEO fraud attacks

Early fraud detection depends on awareness of common patterns. Here are the typical “red flags” that indicate an email or request might be a CEO impersonation scam:

• Unexpected urgency: Requests made call for immediate action or a tight deadline.
• Secrecy or confidentiality: “Don’t tell anyone” and “for internal use only” are red flags.
• Strange payment instructions: A sudden change in bank account details or vendor information days before a scheduled payment.
• Language or style: A sentence that sounds awkward, odd punctuation, or discordance with the executive’s overall tone.
• Domain mismatch/sender mismatch: The displayed sender does not match the sending or from a lookalike domain.
• After-hours special requests: Requests submitted during off-hours (after-hours or weekend) are priority payments or actions outside of the pipeline.
• Attachments and links: Unrequested attachments or login links.
• Voice or video anomalies: Minor differences in the timing, tone, or quality of voice calls can indicate synthetic speech, underscoring the need for security awareness training.

Halting the assault: A response to the criminals

A swift, coordinated response can reduce loss and increase chances of recovery. Here are some practical steps for workers and businesses.

Steps for employees: Immediate actions

1. Verify: Don’t accept urgent financial requests or other appeals at face value; wait for a second confirmation on a different channel.
2. Confirm: Use known lines of communication to confirm requests.
3. Escalate: If someone requests something suspicious that involves money or sensitive information, report the issue right away.
4. Keep evidence: Keep emails, headers, voicemails, and any attachments. Do not delete or alter them.
5. Use the response playbook: If your business has an incident response that is documented, follow it. If not, let your direct manager know immediately.
6. Contact banks: If the money was moved, the finance team must immediately contact receiving banks to request a hold and recovery of any funds paid over.

Steps for companies: Your operational response

1. Incident response: Security, legal, communication, and finance teams should be called in within minutes.
2. Contain and evaluate: Assess the level of the incident. This includes the number of accounts compromised, data exfiltration, and funds transferred.
3. Contact banks and police: Early bank notification can mean funds recovery is possible. Report the incident to the police as soon as possible.
4. Revoke credentials: Disable and rotate any affected accounts and login credentials.
5. Communicate: Support staff with clear guidelines; if necessary, make regulatory announcements, and inform customers.
6. Preserve: Work with IT/forensics to preserve logs, mail headers, and snapshots of the system for analysis.
7. Analysis: Look for spoofed domains or compromised credentials and find the flawed process.
8. Update policies: This is a teachable moment: update controls and conduct targeted awareness sessions.

How to prevent CEO fraud scams

Preventing fraud must be multi-dimensional: people, process, technology, and include employee awareness training through simulated phishing attacks and CEO fraud attempts. Here is some practical advice for employees and companies:

Guide for employees: Everyday vigilance

• Verify strange requests: Always double-check money or data requests using a secondary means of communication, such as a known or official telephone number, or in person.
• Adopt a 24-hour rule: For non-emergency payment requests, you should have a cooling-off or mandatory review period.
• Don’t give out credentials: Never share passwords, 2FA codes, or authorization tokens via email or chat.
• Be careful about links and attachments: Hover over links to check the destination, and verify with the sender off-channel before opening attachments.
• Report suspicious activity: If something smells fishy, report it straight away to IT/security or your manager.
• Keep public personal profiles clean: Reduce the degree of detail available to attackers for social engineering by minimizing personal and role-based information on LinkedIn and public websites.

Guide for companies: Policy, tech, process

• Require multi-factor authentication for high-value transactions: Any wire or large payment should require two approvals and out-of-band verification, like a voice call to a known number.
• Implement email authentication: Implement a reject or quarantine policy against unauthenticated messages; monitor for look-alike domains.
• Phishing exercises: Train teams with real-world examples and attacks to boost awareness and assess risk.
• Vendor onboarding process: Keep a verified register of vendors and validate these with a pre-defined process when changes to banking details are requested.
• Secure remote communications: Rely on verified meeting links, require executive meetings to have authenticated participants, and restrict the ability to share screens.
• Keep an incident response plan: Include bank contact points, instructions on how to report to law enforcement, and templates for communication.
• Insurance and legal: Assess your cyber insurance policy and notify the legal team when there has been a breach.

Technology vs the human firewall

Humans are often referred to as the ’weakest link’ when it comes to cybersecurity, but with support, every employee of a business can become the strongest defense. Technology protects at scale (email auth, anti-phishing filters, anomaly detection), but social engineering leverages human trust.

A resilient and effective approach combines automated controls, human controls, and ongoing tuning. Both human and technological components are needed to prevent attacks: the technology cuts out noise and stops most of the attacks; a human firewall rejects the small percentages that reach people.

Examples of CEO fraud email scams in real life

The three real-life examples of the biggest CEO frauds documented below demonstrate the potential cost and credibility of CEO impersonation scams.

FACC: €42–50 million in losses (since 2016)

In 2016, an Austrian aerospace firm called FACC admitted that hackers had imitated the company’s CEO in an email and persuaded employees to send up to €42-50 million ($47-56 million) in payments overseas.

Ubiquiti Networks: $46.7 million fraud (2015)

Ubiquiti announced that $46.7 million in transfers from a Hong Kong subsidiary to accounts of the company overseas had been swept up into “a criminal fraud” involving employee impersonation and fraudulent requests.

Toyota Boshoku (Toyota parts supplier): ¥4 billion / ~$37 million (2019)

The company’s European arm made a mistake and transferred ¥4 billion (US$37 million) to a swindler as a result of a compromised email attack. The case demonstrates that even large manufacturers can be hoodwinked.