Phishing, fraud, and impersonation
Executive impersonation
Executive impersonation is the use of a leader's name, likeness or authority, through fake social profiles, lookalike email domains, cloned websites or messages, to defraud employees, customers, investors or partners.
Where it appears
It is a multi-channel problem, and the channel decides who can remove it.
- Social media: profiles using the executive's name and photo to message staff, promote investment schemes or announce fake giveaways.
- Email: lookalike domains or display-name spoofing used for CEO fraud and supplier fraud.
- Web: pages that quote or feature the executive to lend credibility to a scam.
- Messaging apps: direct approaches to employees that begin with a friendly note and end with a request.
Why it is hard to close
Each platform has its own impersonation policy and its own reporting form, and most require proof that the person being impersonated is real and has not consented. A fake profile removed on one platform often reappears on another. The work is therefore continuous: watch for new accounts and domains, keep the evidence of identity ready, and report quickly.
Response
- Capture the profile or page, its URL, the date and any messages sent, before reporting; content is removed without warning.
- Report through the platform's impersonation process with the identity evidence it asks for.
- For lookalike email domains, go to the registrar with the registration record and the evidence of use.
- Tell the people most likely to be targeted, usually finance, HR and executive assistants, what the current lure looks like.
Related terms
Sources
- NCSC: whaling, how it works and what your organisation can do about it
- FBI IC3: business email compromise
External guidance is general. Adapt it to your legal, regulatory and operational requirements.