CEO Fraud: How Scammers Impersonate Executives
CEO fraud, also called business email compromise (BEC), is a sophisticated scam where criminals impersonate company executives to trick employees into transferring funds or sensitive information. The scammer typically targets finance departments or employees with access to company accounts, creating a false sense of urgency to bypass normal verification procedures. According to the FBI, BEC schemes cost organizations over $2.7 billion annually, with the average incident resulting in losses between $50,000 and $200,000. This scam has evolved significantly since 2013, when it first emerged; modern variants now include payroll diversion schemes, vendor payment fraud, and wire transfer requests disguised as confidential acquisitions. Unlike phishing attacks that cast a wide net, CEO fraud is highly targeted and researched, with scammers studying company hierarchies, employee relationships, and financial processes before launching attacks.
Common Tactics
- • Sending emails from spoofed or lookalike email addresses that mimic the CEO or CFO's actual address, often differing by one character or using similar domain names like 'companynme.com' instead of 'company.com'.
- • Creating artificial urgency by claiming a confidential acquisition, emergency wire transfer, or time-sensitive business matter that requires immediate action before regular business hours or outside normal verification procedures.
- • Requesting wire transfers to newly opened bank accounts, cryptocurrency wallets, or offshore accounts, often disguised as vendor payments, employee bonuses, or settlement fees that seem plausible to finance staff.
- • Using reconnaissance gathered from LinkedIn, company websites, and social media to reference specific employees, projects, or financial details that make the request appear legitimate and well-informed.
- • Instructing victims to maintain absolute secrecy and avoid discussing the transaction with other employees, claiming the matter is confidential due to acquisition discussions, regulatory issues, or legal matters.
- • Following up with additional pressure emails or calls from 'attorneys' or 'accountants' posing as third parties who reinforce the urgency and legitimacy of the financial request.
How to Identify
- Emails from executives requesting unusual wire transfers, especially to new vendors or accounts, or asking to bypass standard payment approval processes without clear business justification.
- Sender addresses that are nearly identical to known executives' emails but contain subtle spelling variations, alternative domain extensions, or use external email services instead of company domains.
- Requests marked as highly confidential, urgent, or time-sensitive with instructions to avoid discussing the matter with accounting, legal, or other departments who would normally verify such transactions.
- Grammar, tone, or formatting inconsistencies in emails from executives, such as unusual phrasing, missing contact information, or lack of standard email signatures typically used by company leadership.
- Wire transfer requests to unfamiliar vendors, new payees, or accounts in different countries, particularly when the requesting executive normally communicates through other channels or has never requested wire transfers before.
- Follow-up communications from supposed attorneys, accountants, or business associates who add pressure and legitimacy by confirming details of the transaction or providing false legal documentation.
How to Protect Yourself
- Establish mandatory verification protocols for all wire transfers and fund transfers exceeding a specified threshold ($10,000+), requiring verbal confirmation through a known phone number, not one provided in the email.
- Create a company-wide list of email addresses and communication preferences for all executives, and train employees to verify requests through alternate channels (phone call to known number, in-person verification, or secondary email).
- Implement multi-factor authentication on all email accounts, particularly those with financial access, and enable email domain authentication standards (SPF, DKIM, DMARC) to prevent email spoofing.
- Establish a policy requiring that wire transfer requests always be approved by at least two employees in different departments, with documented approval trails separate from email communications.
- Conduct regular security awareness training specifically focused on CEO fraud, including simulated phishing emails and scenarios that test employees' ability to identify spoofed communications and follow verification procedures.
- Monitor for anomalous account activity, such as email forwarding rules, unexpected login locations, or new device access to executive accounts, which may indicate account compromise before fraud occurs.
Real-World Examples
A finance manager at a mid-sized manufacturing company received an email from 'the CEO' requesting an urgent wire transfer of $85,000 to a new vendor account for a confidential acquisition closing that day. The email came from a domain that differed by one letter from the company's actual domain, and included a request to keep the matter private. Within hours, the employee transferred the funds without following the company's normal three-person approval process. By the time the real CEO returned from a client meeting and asked about the transfer, the money had been moved through multiple international accounts and was unrecoverable.
An HR director at a technology firm received what appeared to be a message from the CFO requesting employee W-2 information and direct deposit details for 'payroll system updates.' The scammer gained access to personal information for 240 employees, which was then used in identity theft and tax refund fraud schemes. The email address used was almost identical to the CFO's actual address but used a slightly different domain. HR staff did not verify through their normal channels because the request came from someone they 'recognized' and involved standard business processes.
A startup's accounting department received multiple emails over three days from the company's co-founder requesting wire transfers totaling $180,000 for investor relations expenses and legal settlement fees related to a pending acquisition. The emails included specific reference to board members and financial details found on the company's private investor documents. Follow-up calls from someone claiming to be the company's attorney reinforced the urgency. The finance team made the first two transfers before realizing the emails were fraudulent when the co-founder's actual assistant called to confirm a completely different payment.