CEO fraud

How it works

Europol describes CEO/BEC fraud as an employee authorized to make payments being tricked into paying a fake invoice or making an unauthorized transfer out of the business account. A fraudster calls or emails posing as a high-ranking figure such as the CEO or CFO. The fraudster shows good knowledge of the organization, asks for an urgent payment, and asks the employee not to follow the regular authorization procedures.

Europol lists language that often appears: appeals to confidentiality, "the company trusts you", and "I am currently unavailable". Instructions may arrive later from a third person or by email. Requests are often for international payments to banks outside Europe.

The FBI uses the same name. A 2016 IC3 advisory describes a scenario in which the email accounts of high-level executives are spoofed or hacked and a wire request goes to the employee who normally processes such requests, and says this scenario "has also been referred to as 'CEO Fraud'".

Warning signs

Europol's signs include an unsolicited email or call, pressure and a sense of urgency, direct contact from a senior official the employee does not normally deal with, a request that contradicts internal procedure, a demand for absolute confidentiality, and unusual flattery or promises of reward.

How executive data feeds it

The "good knowledge about the organization" is the part exposed data supplies. A fraudster needs the executive's real name and title, a plausible email address, the names of finance staff, the vendors in use and the typical phrasing. Some of it is public. Some comes from earlier breaches, where an executive's email address, phone number and passwords may appear. A mailbox opened with a leaked credential removes the need to imitate anyone. CEO fraud and BEC: which exposed data fields make it convincing covers the fields in detail.

Reducing the risk

Europol advises companies to implement internal payment protocols and a procedure to verify the legitimacy of payment requests received by email, to establish reporting routines for fraud, and to review information posted on the company website and on social media. It advises employees to apply payment procedures strictly, not to give in to pressure, and to check email addresses carefully. Add a rule that no executive can waive the verification step, so a request that demands exceptions is itself the red flag.

How it differs from related terms

CEO fraud is a subtype of business email compromise. Whaling is aimed at senior people as victims, while CEO fraud usually uses a senior person's identity to target junior staff. Pretexting is the broader technique of building a believable false scenario, which CEO fraud applies.