Phishing, fraud, and impersonation
CEO Fraud
CEO fraud is a form of business email compromise in which the attacker poses as the chief executive or another senior leader and pressures an employee, usually in finance or HR, into making a payment or releasing confidential information.
The pattern
The message is short and plausible. It comes at an awkward moment, late on a Friday or while the real executive is known to be travelling, and it asks for something that sounds routine: pay this invoice today, buy gift cards for a client, send the payroll report. It stresses urgency and discretion, and it discourages the recipient from checking with anyone.
The name is real. The address usually is not: a lookalike domain, a webmail account with the executive's display name, or, in the worst case, the executive's real mailbox after a compromise.
Why it works
The request comes from the person least likely to be questioned, aimed at the people most able to act on it. Attackers learn names, titles and travel from public sources, so the details are right. And the ask is small enough, or urgent enough, to skip the usual checks.
Controls that hold
- A payment or bank-detail change is never actioned on email alone; it is confirmed by a call to a known number.
- Executives are told their name will be used this way, and that staff are expected to verify.
- Lookalike domains for the company name are monitored and challenged at the registrar before they are used.
- Email authentication (SPF, DKIM, DMARC) is enforced so exact-domain spoofing fails.
Related terms
Sources
- FBI IC3: business email compromise
- NCSC: whaling, how it works and what your organisation can do about it
External guidance is general. Adapt it to your legal, regulatory and operational requirements.