CEO fraud: when the person writing to you is not your boss

There is no malware. No flaw is exploited. CEO fraud relies on something much older: trust in whoever gives the orders. Someone impersonates the managing director, the CFO or a supplier and requests an urgent, confidential transfer. Excusing it as professional secrecy, the victim skips the very procedures designed to protect them.

It is one of the frauds that moves the most money, and in recent years it has levelled up: it is no longer just an email — it is also a cloned voice or a fake video call.

A classic that returns upgraded

The classic scheme works by email:

1. A message that appears to be from the director, with their signature and tone.
2. “I'm in a meeting, don't call me, reply here.”
3. The request: an urgent transfer, a payment to a new supplier or a change of bank account.
4. The secrecy excuse: “don't discuss this with anyone, it's a confidential deal.”

The message works because the attacker did their homework: name, role, open projects, real suppliers of the company. They can pull that from the corporate website, social media or industry press.

The usual signals

• Extreme urgency. “I need you to do this now, before the deal closes.”
• Requests for secrecy. “Don't discuss it with anyone”, “it doesn't go through the usual process”. It is the most consistent signal.
• Unusual channel. The director who never writes on WhatsApp suddenly does; or uses an email similar to theirs with one letter changed.
• Bank account changes. Any IBAN change, wrapped in urgency, is a prime fraud target.
• The person is unavailable. “Don't call me, I'm in a meeting / on a flight / out of coverage.”

The new threat: cloned voice and video

With a few seconds of public audio — a video on social media, a voice note, a webinar appearance — a voice can be cloned convincingly. There are real cases of companies transferring large sums after a video call with a “director” who was actually a manipulated video.

The conclusion is uncomfortable but clear: seeing and hearing the person is no longer proof of identity. The defence cannot be technological; it has to be procedural.

The protocol that stops it: out-of-band verification

“Out of band” means checking a request through a channel different from the one you received it on, with a contact you know:

• Call the usual number. If the number in the message is not the one in your address book, do not call that one: call the number you already knew — or their assistant's.
• Double approval for payments. Nothing moves on a single voice, however urgent. For payments above a threshold, two people from two different departments.
• Bank detail changes = verification, always. If a supplier changes their account number, call them on their usual number before updating anything (this is a classic fraud on its own).
• No operational secrets. A procedure that only works if nobody checks it is not a procedure: it is an invitation.
• A clear agreement with management: if management itself is on board, the fraud dies. A written rule that “urgent things always get verified” is enough.

Train the finance team (and anyone who pays)

The preferred targets are the people with access to payments: administration, accounting, finance management. A 30-minute session with these three messages covers the essentials:

• Urgency and secrecy are warning signs, not signs of importance.
• Verifying is not distrusting: it is the procedure.
• Nobody should be punished for stopping a payment and asking. The costly thing is the opposite.

CEO fraud is also best tested with internal simulations: a test email mimicking the request, and seeing who verifies and who does not. If you want ideas to set it up, the article on phishing against employees has the method.

If you fall for it: the first minutes count

1. Call the bank immediately. If the transfer has just left, there are urgent recall options. Every minute counts.
2. Report it to the police. Keep all the evidence: messages, headers, numbers, timestamps. A police report is necessary and can sometimes freeze movements.
3. Report the incident to INCIBE so they can warn other companies about the same scheme.
4. Check your corporate email. Sometimes the attacker is not spoofing: they are inside. Check forwarding rules, active sessions and recent access.
5. Harden your domain identity. If your email was spoofed, protection runs through SPF, DKIM and DMARC: we cover it in this guide.

The rule that sums it up

Urgent things get verified; confidential things get double-checked. No company can prevent fraud attempts. What it can choose is whether its team has clear instructions to stop them — and whether verifying is normal, not heroic.

If you want to know how exposed your company is (including the data already circulating out there and the emails being sent in its name), start with the free OSINT audit: report within 72 hours, no access to your systems and no strings attached.