CEO Fraud: How Executive Impersonation Emails Actually Work

CEO fraud is the cheapest form of business email compromise, because it often requires no compromise at all. The attacker just needs to look like the boss for ninety seconds.

The anatomy

First, research: LinkedIn, the leadership page on your website, a conference agenda, an earnings call. The attacker learns who signs off on payments, who reports to whom, and when the executive is traveling.

Then the setup: a lookalike domain, a display name that reads correctly on a phone, or a free webmail account claiming to be a personal address. Often it starts with a harmless question — "Are you at your desk?" — to establish a thread before money is mentioned.

Then the ask: urgent, confidential, and time-boxed. A vendor payment that must go out today, a wire for an acquisition nobody can know about, gift cards for a client, or a payroll direct-deposit change. Authority plus urgency plus secrecy is the entire mechanism.

Why filters miss it

There is no attachment, no link, and no malware. The message is text. Sent from a domain with clean reputation and valid SPF for itself, it looks technically legitimate — because it is. The fraud is social.

Controls that actually work

• Out-of-band verification for any payment or banking change, using a phone number from your records rather than one in the email
• Dual authorization above a dollar threshold, with no exception for urgency
• External sender tagging and impersonation protection tuned to executive display names
• DMARC at enforcement so your own domain cannot be spoofed outright
• Lookalike domain monitoring and defensive registration of the obvious variants
• A stated cultural rule: no executive will ever ask for a secret, urgent payment, and no employee will be penalized for verifying

Test it

Simulate this specific scenario with your finance team through awareness and phishing training. A finance clerk who has already refused one fake CEO once will refuse the real attack.

If a payment already went out, move to wire fraud recovery immediately — the recall window is short.

---

Business email compromised right now? Call 1-844-LYRA-REC — our incident commanders answer live 24/7 and start containment on the first call. See our business email compromise response page for the first-hour checklist.