CEO Fraud: How the Scam Works and How to Protect Yourself

CEO fraud needs no malware and no link. A well-written email, a little research and the right moment are enough. That is why the scam works so well, even in large companies. In 2016 the German automotive supplier Leoni reported a loss of around 40 million euros from fake payment instructions.

How CEO fraud works

1. Research: The criminals gather information from the website, the commercial register, LinkedIn and press releases. Who is the managing director, who makes payments, when is the boss travelling?
2. Contact: An email that seems to come from management goes to accounting. Often it uses a lookalike domain or a free mail account with the right name.
3. Pressure and secrecy: "We are acquiring a company. This is strictly confidential. Please make the transfer today, I am in a meeting and cannot be reached."
4. Reinforcement: Sometimes a supposed lawyer or adviser also gets in touch, by email or phone.
5. Transfer: The money goes to an account at home or abroad and is moved on quickly.

CEO fraud, BEC and spear phishing

• Business email compromise (BEC): Umbrella term for fraud with fake or hijacked business emails. It includes fake supplier invoices and changed bank details.
• CEO fraud: A BEC variant in which the criminals impersonate management.
• Spear phishing: Targeted phishing emails to individual people. CEO fraud is often the result of that groundwork.
• Whaling: Spear phishing aimed at management itself.

Warning signs

• A payment instruction that departs from the usual process.
• Time pressure and a request for absolute confidentiality.
• The supposed person "cannot be reached" but asks for immediate action.
• A new recipient account, often abroad.
• A sender address that is almost right, or a free mail account with a familiar name.
• A reply-to address that differs from the sender address.

New: CEO fraud with deepfakes

Criminals now fake voices and faces too. A call sounds like the managing director, a video call seems to show the CFO. How these fakes are made and how to prepare is covered in the entry on the deepfake threat to companies. The key rule stays the same: always confirm unusual instructions through a second, known channel.

How to protect your company

Processes

• Four-eyes principle: A second person always approves payments above a set amount.
• Call back on a known number: New bank details and unusual instructions are confirmed by phone, always on the number on file.
• A clear rule from the top: Management states explicitly that it never asks for confidential urgent transfers by email.

Technology

• Sender checks: With SPF, DKIM and DMARC and a strict policy, nobody can forge your exact domain.
• Gateway rules: A secure email gateway detects lookalike domains and display names that impersonate someone from management.
• Tag external mail: A notice on mail from outside makes a supposed message from the boss sent from a foreign address visible.

People

• Training: Accounting, assistants and HR are the most common targets. They should know the scam. Learn more in our awareness training.
• A no-blame culture: Nobody is punished for asking or reporting a mistake. Otherwise no one dares to question management.

What to do if money has already been transferred

1. Call your bank immediately and ask for the payment to be recalled. The faster you act, the better the chances.
2. Report it to the police. In Germany, every federal state has a central cybercrime contact point (ZAC) for businesses.
3. Secure emails, account details and notes of any calls.
4. Check whether a mailbox has been compromised. An incident response team can help if needed.

CEO fraud and the SecTepe Mail Security Gateway

The phishing protection in the SecTepe Mail Security Gateway checks the display name against protected people such as management or the head of finance. It detects lookalike domains, including those using characters from other alphabets. If a language model is connected, it also assesses the text, for example an urgent request for a transfer or gift cards. The model can run on your own GPU server, so the mail text stays in your own network. An optional behavior analysis reports when a known sender suddenly behaves differently.

Conclusion

CEO fraud relies on authority, time pressure and secrecy, not on technology. The best protection is fixed payment processes, a callback on known numbers and trained employees. Technology in the mail flow catches many attempts in advance, but it does not replace these rules.