CEO Fraud

Overview

Meaning and boundaries

CEO Fraud is a form of business email compromise or impersonation in which an attacker poses as a senior executive to pressure staff or partners into sending money, changing payment details, disclosing data, or bypassing controls. CEO fraud exploits apparent executive authority to induce a sensitive action, commonly a wire or crypto payout, new beneficiary, payroll change, or disclosure of credentials. Messages may spoof an address, hijack an actual account, or rely on voice or messaging impersonation.

How it works in practice

It relies on authority, urgency, secrecy, and organizational knowledge rather than necessarily compromising the executive’s actual account. High-risk changes or instructions should be verified through a trusted independent channel, and controls should not rely on information supplied inside the potentially compromised message or session. In this context, controls require independent verification of unusual requests, dual approval, protected supplier changes, payment limits, executive communication rules, domain monitoring, and a culture that permits employees to challenge urgent instructions. Records should preserve the original request, account and device events, approvals, beneficiary changes, transaction identifiers, communications, authentication results, review notes, and recovery actions. Teams should connect related attempts without exposing unnecessary personal or credential data. Useful measures include attempted and confirmed loss, prevented value, false-positive rate, review time, recovery rate, beneficiary-change exceptions, customer complaints, repeat attacks, and control-bypass findings. The relationship with Beneficiary Name Check should be documented where it affects residual risk or control ownership.

Checks and failure points

Verify urgent payment requests using an independent pre-established channel, not the phone number or link included in the suspicious request. Segregate beneficiary setup from payout authorization and enforce thresholds even when a senior person claims urgency.

How it differs from related terms

CEO fraud is a role-impersonation subset of business email compromise; the broader category also includes supplier invoice redirection and account takeover. Related entries: Invoice Fraud; Business Email Compromise (BEC); Beneficiary Name Check.