CEO fraud: how business email compromise works and the processes that stop it

By Kike Gandia · Co-Founder & CEO, OSCP

CEO fraud is a scam in which a criminal impersonates an executive, a supplier or an adviser so that someone with payment authority makes an urgent transfer to an account the criminal controls. It is the best-known form of business email compromise (BEC) and needs no malware: a convincing email or call at the right moment is enough. That is why technology alone does not stop it; payment processes that nobody skips, even when the pressure seems to come from the CEO, do. This guide covers the variants, how attacks are prepared, the warning signs, the controls that work, what the EU's Verification of Payee adds and what to do if the money has already gone.

What CEO fraud is and why it still works

CEO fraud is the best-known variant of what the FBI and the industry call BEC (business email compromise): a scam aimed at companies that work with suppliers or make transfers frequently, in which the attacker impersonates someone trusted —by email, phone or video call— to divert a payment. There is no exploit or virus to detect: the employee who sends the transfer does so with their own legitimate credentials, convinced they are following a real instruction.

Two figures to size it:

The FBI's 2025 IC3 Annual Report records 24,768 BEC complaints and $3.046 billion in reported losses, the second-largest loss category after investment fraud. These are complaints filed with the FBI, mostly from the United States, so they do not measure the global problem.
In Spain, the national cybersecurity institute INCIBE places CEO fraud among the ten topics companies ask its cybersecurity helpline about most.

It works because it exploits how a normal company operates: hierarchy, deadlines, confidentiality around sensitive deals and a finance team paying invoices to dozens of suppliers. The defence therefore has to sit in the payment process, not only in the email filter.

The variants: fake executive, fake supplier and others

Several different scripts share the same name. It pays to know them all, because each one reaches a different person in the company:

Variant	Who is impersonated	What they ask for	Who is targeted
Fake executive	CEO, CFO or partner	An urgent, confidential transfer, often to an account abroad	Finance, treasury, accounts
Fake supplier (bank detail change)	A real supplier with open invoices	Paying upcoming invoices into a new bank account	Accounts payable
Fake lawyer or confidential deal	A law firm, auditor or adviser on a supposed acquisition or merger	A payment to close the deal without telling anyone	Finance leadership
Payroll diversion	An employee	Changing the account their salary is paid into	HR, payroll provider
Information theft	An executive	Employee data, customer lists or outstanding invoices, as a first step towards another fraud	Accounts, HR

The fake supplier is usually the hardest to spot: it does not require the employee to break any procedure, only to update a bank detail, and the invoice they pay is real, for an expected amount and on the expected date. The fake executive, by contrast, relies on the victim skipping the process under hierarchical pressure, and is fought mainly through culture: nobody gets reprimanded for verifying an order from the boss.

Increasingly, the first email is reinforced with a call or a voice note in the executive's voice, sometimes generated with AI. We cover that in detail in the guide to vishing and voice deepfakes.

Compromised account, look-alike domain or spoofed display name

The technical question that most shapes the defence is where the fraudulent message comes from. There are four situations, and different controls work for each:

Origin of the email	What it looks like	What stops it
Spoofed display name	The executive's name, but on a personal Gmail or Outlook address	External sender tag, basic awareness
Look-alike domain	company-ltd.com instead of company.com, or one swapped letter (rn for m)	Look-alike domain detection, checking the full address, out-of-band verification
Exact domain spoofing	Appears to come from your own domain or your supplier's	DMARC at p=reject and an email gateway that enforces DMARC on inbound mail
Genuinely compromised account	The real address, inside a real thread, with the usual tone and signature	Only out-of-band verification; on your own accounts, phishing-resistant MFA and mailbox rule alerts

The last case dismantles the advice to “check the sender”. When the attacker is inside a supplier's mailbox —or your own CFO's— the email comes from the legitimate account, replies to a genuine conversation and attaches an invoice that looks right. INCIBE notes that in most cases criminals spend several weeks inside the victim's mailbox, watching conversations and creating rules so the victim does not see what they do not want them to. That is why no email-based control is enough on its own: a bank detail is confirmed through another channel or it is not changed.

If the compromised account is one of yours, forwarding and inbox rules are the footprint to look for; we explain it in the resource on malicious forwarding rules in Exchange Online.

How a CEO fraud attack is prepared

A well-executed CEO fraud is an intelligence job done in advance, not a mass email. These are the typical phases:

Reconnaissance (OSINT): the corporate website, LinkedIn, press releases, company registries and social media reveal the org chart, who signs payments, the main suppliers and customers, and how names and job titles are written. Email signatures and out-of-office replies complete the picture: they say who is travelling, until when and who to contact in their absence.
Infrastructure: registering a look-alike domain, creating an email account in the executive's name or, in the most elaborate version, getting into a real mailbox through credential phishing.
Timing: holidays or trips of the impersonated executive, quarter-end or year-end when finance is rushed, days before a large known payment, or right after corporate news —an acquisition, a funding round, a new customer— that makes a confidential deal believable.
Execution: a short first message to check the victim responds (“are you in the office? I need you to handle something discreetly”), a move to WhatsApp or a personal phone and, only then, the payment request, sometimes split into several amounts.

The more a company publishes about who decides and how it pays, the cheaper it is for the attacker to build the script. Reviewing what you publish is also defence, and it is exactly what an offensive OSINT exercise measures before a simulation.

Warning signs of CEO fraud

No single sign proves fraud, but a combination of several should stop any payment:

Urgency with a deadline: the payment has to go out today, before the bank closes or before a meeting.
Secrecy: “don't mention this to anyone”, “it's a confidential deal”, “I'll speak to the CFO later”.
The executive cannot be reached: they are on a flight, in a meeting or abroad, and ask not to be called.
Channel switch: the conversation jumps from corporate email to WhatsApp, an unknown mobile number or a personal email.
Bank detail change: a long-standing supplier announces a new account, often in another country or in the name of another company, with an excuse such as an audit, a change of bank or a subsidiary.
Exceptions to the procedure: requests to skip dual approval, pay outside the usual payment run or not record the invoice yet.
Small inconsistencies: a domain with one different letter, a tone more formal or more casual than usual, a signature without the usual phone number, an invoice PDF with a slightly different layout.
Flattery and hierarchical pressure: “I'm trusting you with this”, “don't let me down”.

The first three are the core of the fake executive script; the fifth is the core of the fake supplier one. When any of them appears, the answer is not to investigate the email but to apply the verification procedure.

The processes that stop CEO fraud

This is the most important part of this guide. Technical controls reduce how many attempts arrive; processes decide whether an attempt that arrives ends in a loss. These are the ones that work, as long as they are written down, approved by management and followed even when the pressure comes from an executive:

Process	What it stops	How to implement it
Out-of-band verification	Fake executive, fake supplier, compromised account	A call to a phone number already in your records, never the one in the email or on the invoice
Dual approval	Urgent payments ordered by a single person	Two people authorise any transfer above a threshold, configured in online banking and not just in a manual
Bank detail change rule	Fake supplier, payroll diversion	No account change is accepted by email: it is confirmed by phone with a known contact and entered in the ERP by someone other than whoever approves payments
Holding period for new payees	Urgent payments to newly added accounts	A fixed delay between adding or changing an account and the first payment, unless enhanced verification is done
Code word	Calls or voice notes imitating the executive's voice	A word or question agreed in person to validate payment orders that fall outside the usual process
Verifying is not distrust	Hierarchical pressure	Management states in writing that nobody will be reprimanded for delaying a payment to verify it

Some details that make the difference in practice:

The verification number comes from the supplier master file or the internal directory, not from the signature of the email asking for the change. If the attacker controls the supplier's mailbox, they also control that signature.
Your company makes the call. An incoming call that “confirms” the change does not count: it may come from the attacker.
The dual approval threshold must sit below the usual amounts of large invoices, or the attacker will simply split the payment.
The holding period can be one or several business days. Each company sets the figure according to its payment rhythm, but it has to exist and apply to urgent payments too.
Employee bank detail changes for payroll follow the same rule as supplier ones.

On top of that, some cyber insurance policies make social engineering fraud cover conditional on a verification procedure for bank account changes having been in place.

Technical controls that reduce exposure

No technical control stops CEO fraud on its own, but several sharply reduce the attempts that reach the inbox and cut off the most damaging variant, the compromised account:

DMARC at p=reject, with SPF and DKIM properly aligned: it stops anyone sending email that appears to come from exactly your domain. It mainly protects your customers and suppliers from fake emails in your name; to protect you, your email gateway has to enforce the DMARC policy of the domains that write to you. It does not stop look-alike domains or genuinely compromised accounts.
Look-alike domain detection: monitoring registrations of domains similar to yours and to those of key suppliers (swapped letters, hyphens, other extensions). Free tools such as dnstwist generate and check those variants, and some email gateways flag newly registered domains.
External sender tag or banner: a visible notice on every email that comes from outside the organisation. It exposes the simplest case, the “CEO” writing from an external address with their name on it.
Phishing-resistant MFA (FIDO2 keys, passkeys or certificate-based authentication) for email, starting with executives and finance. SMS or push-notification MFA can be bypassed with adversary-in-the-middle phishing, which steals the already authenticated session.
Mailbox rule and external forwarding alerts: block automatic forwarding to external domains unless an exception is approved, and alert when a rule is created that forwards, moves or deletes email. It is the most reliable footprint of a compromised mailbox.
Change control in the ERP: logging and alerting on any change to bank details in the supplier and employee master files, with segregation of duties between whoever changes them and whoever pays.

In Microsoft 365 and Google Workspace almost all of this is configuration, not a new product. Checking that it is active, and that nobody has opened exceptions over time, is part of any security audit of the email platform.

Verification of Payee: what it adds and where it falls short

Since 9 October 2025, banks and other payment service providers in euro-area countries must offer Verification of Payee before the payer authorises a euro credit transfer. It comes from Article 5c, which Regulation (EU) 2024/886 on instant payments inserted into Regulation (EU) No 260/2012. It applies to standard and instant transfers, through any channel, and is free of charge. In Member States that do not use the euro, the deadline is 9 July 2027. It is similar in spirit to the UK's Confirmation of Payee.

How it works: the payer's bank asks the payee's bank whether the name you entered matches the holder of the IBAN and, before you authorise, shows you one of these results:

Result	What it means	What to do
Match	The name matches the account holder	Follow the usual process
Close match	Similar, and the bank shows you the actual holder's name	Check that name before continuing
No match	The account belongs to someone else	Do not pay without out-of-band verification
Verification not possible	The check could not be completed	Treat it as unverified

It is real progress against the crudest fake supplier: if the attacker asks you to pay a company's invoice into an account held by a private individual, the bank will warn you. But it has limits worth knowing:

It does not detect an account in the fraudster's name if you enter that name. If the email says “from now on, please pay our factoring company” and you type the name it gives you, the result will be “match”: the account exists and is in that name. Verification checks that the name matches the IBAN, not that the payee is who you think.
A warning does not block the payment. The regulation makes clear the payer can still authorise the transfer; the bank only has to warn that the money may end up in an account not held by the intended payee. A well-prepared script anticipates the warning (“your bank will flag our new account, that's normal”).
Companies can opt out for bulk payments. Payment users who are not consumers can switch verification off when submitting several orders as a package, such as a supplier payment run. If your company pays that way, check whether it has opted out and, if so, make sure the control happens when an IBAN is added or changed.
The obligation covers euro transfers within the EU. A payment to an account outside the Union or in another currency need not go through this check, and that is exactly where many fake executive scripts point.

In short: Verification of Payee is a useful safety net, not a substitute for the bank detail change rule or for the call to a known number.

What to do if the transfer has already been made

If the money has already gone, every hour counts: the sooner you act, the more likely the funds are still in the destination account. In this order:

Call your bank immediately, do not send an email. Ask it to attempt a recall of the transfer and to alert the receiving bank. In Spain, Article 59 of Royal Decree-Law 19/2018 on payment services (which transposes the EU rule on incorrect unique identifiers) says a transfer executed to the IBAN provided counts as correctly executed, but the payer's bank must make reasonable efforts to recover the funds and the payee's bank must cooperate. That does not guarantee a refund: if the money has already been moved to other accounts, recovering it is very difficult.
Report it to the police. In Spain, that means the Policía Nacional, the Guardia Civil or the competent regional police, with every detail of the transaction: amounts, dates, destination IBAN and bank, and copies of the communications. In the United States, the FBI asks victims to file a complaint at ic3.gov whatever the amount. A police report is also worth having for the bank and the insurer.
In Spain, call 017, INCIBE's free and confidential cybersecurity helpline, which also advises companies in these cases.
Preserve the evidence: do not delete emails, save them with full headers, export WhatsApp messages or voice notes and write down the timeline. Reinstalling or wiping a device before it is analysed destroys information.
Find out whether an account was compromised, yours or the supplier's: review sign-ins, forwarding rules and apps with mailbox access, revoke sessions and change credentials. If the supplier's account was compromised, call them: their other customers may be receiving the same email.
Assess notification duties: if the attacker had access to a mailbox containing personal data, it may be a breach that must be notified to the data protection authority (the AEPD in Spain) within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to individuals.
Notify your insurer if you have a cyber policy. Social engineering fraud cover, where it exists, usually has its own sublimit and notification deadlines that should not be missed.

The guide on what to do if an employee falls for phishing details the step-by-step technical response when the starting point was a click.

How to test your processes before an attacker does

A verification procedure that has never been tested is an assumption. The way to know whether your finance team applies it under pressure is to simulate the attack under controlled conditions:

Spear phishing aimed at finance and accounts: emails imitating an executive or a real supplier asking for a bank detail change or an urgent payment, sent from a look-alike domain registered for the exercise. What is measured is not just who clicks, but who replies, who escalates and who applies the procedure.
Vishing: a call posing as the executive or the supplier asking to confirm or speed up a payment. It is the test that reveals most about the verification culture, because the pressure is in real time.
Bank detail change test: a simulated supplier account change request, to check whether someone calls the number in the master file, whether the change is entered by someone other than whoever pays and whether the holding period is respected.
Tabletop exercise with management and finance: walking through a realistic case (“the CFO is travelling and this request comes in”) and checking that everyone knows what they would do, who they would call and what would happen if the transfer had already gone out.

These exercises are agreed in writing with management, kept to what is necessary and never used to single anyone out: the goal is to find the point where the process breaks, not the employee who fell for it. Before running them, review the data protection and employment law requirements of a phishing simulation with employees.

FAQ

What is the difference between CEO fraud and BEC?

BEC (business email compromise) is the term the FBI and the industry use for scams that divert payments by impersonating someone trusted by email or other channels. CEO fraud is its best-known variant, the fake executive, although the name is often used for the whole family, including the fake supplier asking for a bank detail change.

Will the bank give the money back?

There is no guarantee. If the transfer was executed to the IBAN the company provided, it counts as correctly executed; the bank's duty is to make reasonable efforts to recover the funds, and that depends on them still being in the destination account. That is why you call the bank as soon as the fraud is detected, not the next day.

Does Verification of Payee prevent bank detail change fraud?

It helps against the crude cases, where the new account is in the name of someone other than the supplier. It does not detect an account opened in the fraudster's own name if the email gives you that name, it does not block the payment if you proceed after the warning, and companies can switch it off for bulk payments. It does not replace the verification call.

If we have DMARC at p=reject, are we protected?

Against part of the problem: nobody can send email that appears to come from exactly your domain. But DMARC does not stop look-alike domains or emails sent from the real account of a compromised supplier or executive, which are the most effective variants. It is necessary, but not sufficient.

What should we do if a supplier asks us to change their bank account?

Do not change it by email. Call the supplier on a number you already had on file —not the one in the email or on the invoice—, confirm the change with a contact you know and have it entered in the ERP by someone other than whoever approves payments. Then apply the holding period before the first payment to the new account.

Does cyber insurance cover it?

It depends on the policy. Social engineering fraud is often not part of the base package or has a low sublimit, and some policies require a verification procedure for bank account changes to have been in place. It is worth checking in writing before you need it.

How do I know whether my finance team would fall for it?

By testing it. A spear phishing and vishing simulation aimed at finance, with realistic fake executive and fake supplier pretexts, shows who verifies, who escalates and where the process breaks. It is far more reliable than asking whether the procedure is followed.

Sources

Simulate a CEO fraud attack on my finance team