CEO fraud and executive impersonation: how social engineering targets payments

CEO fraud is a scam in which a criminal pretends to be a senior executive, usually the CEO or CFO, and asks an employee to make a payment, buy gift cards or send sensitive data. It is a variant of business email compromise, and it works because it borrows the authority of the person at the top and adds pressure: urgency, secrecy and a plausible reason.

The FBI's Internet Crime Complaint Center recorded 24,768 business email compromise complaints in 2025, with reported losses of $3,046,598,558 (IC3 2025 Internet Crime Report). The same report notes that AI tools can quickly produce official-sounding emails that mimic a company's CEO, and that voice cloning can be used to request wire payments.

The defense is less about technology than about a few firm rules, backed by email settings that make forging your executives harder.

What a typical attempt looks like

The script rarely changes:

1. The pretext. "I'm in a meeting with the lawyers about an acquisition. I need you to handle a transfer today, and please keep it between us for now."
2. The channel. An email from an address that looks right, a text from an unknown number ("my new phone"), or a voice message that sounds like the executive.
3. The pressure. Deadlines, confidentiality and a hint that asking questions would be unwelcome.
4. The payment. A wire transfer to a new account, a batch of gift cards, or a request for payroll or tax data.

The target is usually someone in finance, accounting or an executive assistant role, because they have the authority to move money and the habit of acting quickly on requests from leadership.

Why it works

Criminals study what an attacker can see from outside: names and titles from the website and professional networks, travel announced on social media, the format of your email addresses, and who reports to whom. With that, a message only needs to sound like the boss on a busy day.

3 technical gaps make it easier:

• Your domain can be forged. Without an enforced DMARC policy, a message with From: ceo@yourcompany.com may reach the inbox even though your servers never sent it. See SPF, DKIM and DMARC explained.
• A lookalike domain exists. yourcornpany.com (with "rn" instead of "m") passes authentication because the criminal owns it. More in lookalike domains and typosquatting.
• Display names are trusted. Many mail apps show only "Jane Smith, CEO", hiding the real address behind it, especially on phones.

Voice and text messages

Impersonation is no longer limited to email. In May 2025 the FBI warned about a campaign using text messages and AI-generated voice messages to impersonate senior US officials, advising people not to assume such a message is authentic (FBI IC3 PSA I-051525-PSA). The same techniques apply to company executives whose voice is available in interviews, webinars or conference talks.

The practical consequence: a familiar voice on the phone is not, on its own, proof of identity.

Rules that stop it

Write these down and make sure every executive supports them openly:

• No payment or bank change is approved on a single channel. An email request is confirmed by phone, a phone request by a message in your internal chat, always using contact details you already have.
• Executives never ask for secrecy around payments. Say this out loud at a team meeting. Once staff know the CEO will never ask them to skip the process, the "keep it between us" line becomes a warning sign.
• 2 people approve new payees and large transfers.
• Gift card requests from leadership are always refused.
• Staff who pause to verify are thanked, never criticized, even if the request turns out to be real.

Email settings worth checking

dig +short TXT _dmarc.yourcompany.com

1. Enforce DMARC with p=quarantine or p=reject, so forged mail from your own domain is not delivered.
2. Turn on your mail system's external sender tag, so messages from outside the company are clearly marked.
3. Enable impersonation protection for executive names if your mail security supports it.
4. Require multi-factor authentication on executive and finance mailboxes, since a real compromised mailbox is the most convincing sender of all.
5. Keep a list of domains that resemble yours and check which of them have MX records.

If someone already paid

Contact your bank at once and request a recall of the transfer, then file a complaint at ic3.gov. The FBI notes that time is of the essence and that IC3 may be able to help financial institutions and law enforcement with the funds (IC3 PSA I-091124-PSA). Preserve the original messages with full headers for investigators.

A short checklist

• 2-channel verification for every payment or bank detail change.
• A clear statement from leadership that secrecy requests are a red flag.
• DMARC enforced, external sender tags on.
• Multi-factor authentication on finance and executive mailboxes.
• Lookalike domains identified and watched.

How Datahorses helps

Datahorses watches your company from the outside the way an attacker would: new domains resembling yours, whether they can send mail, fake login pages, and changes to your SPF, DKIM and DMARC. A person reviews each finding and you get specific steps to take. You can see how this works in how we guard or browse the example dashboard. The related invoice scheme is explained in fake invoices sent in your company's name.