CEO fraud is a scam where attackers impersonate a CEO, owner, executive, or senior leader to pressure employees into sending money, buying gift cards, changing payment details, or sharing sensitive information.

Is CEO fraud a form of Business Email Compromise?

Yes. CEO fraud is a form of Business Email Compromise, or BEC, because it uses impersonation and trust to trick a business into taking a fraudulent action.

What is a common example of CEO fraud?

A common example is an employee receiving an urgent email that appears to come from the CEO asking for a same-day wire transfer, gift card purchase, or confidential payroll or tax records.

CEO Fraud: Executive Impersonation Scam Warning Signs & Prevention

Q: What should an employee do if a CEO request seems suspicious?

Pause the request and independently verify it through a known phone number, internal directory, or established company process before sending money, changing payment details, buying gift cards, or releasing sensitive information.

Verified by GonePhishing.com

CEO fraud is one of the most common and dangerous forms of Business Email Compromise (BEC). In this scam, a criminal pretends to be a CEO, owner, president, executive, or other senior leader and sends a message that pressures an employee to take immediate action. That action may involve sending a wire transfer, buying gift cards, changing payment instructions, sharing tax documents, or releasing confidential company information.

These attacks work because they exploit normal business behavior. Employees are used to responding quickly to leadership, handling urgent requests, and treating executive instructions seriously. A scammer knows that pressure, authority, and timing can sometimes overcome caution. That is why executive impersonation scams continue to succeed even when employees know what phishing is in general.

CEO fraud in simple terms

CEO fraud, also called executive impersonation fraud, happens when a criminal pretends to be a CEO, owner, CFO, president, or other trusted leader and pressures an employee to send money, change payment details, buy gift cards, or release sensitive information. It is a common form of Business Email Compromise (BEC).

What is CEO fraud?

CEO fraud is a scam where an attacker impersonates an executive or senior decision-maker to trick an employee into sending money or sensitive information. The impersonated person may be the CEO, owner, founder, CFO, president, director, attorney, or another leader whose authority carries weight inside the company.

In many cases, the message appears simple and believable. It may ask whether the employee is available, request that the matter remain confidential, or say that a payment must be handled immediately. The scammer relies on trust and urgency more than technical tricks.

How CEO fraud works

Most CEO fraud attacks follow a familiar pattern. The attacker researches the business, learns employee names and responsibilities, identifies someone who can move money or release records, and then sends a message that appears to come from leadership. The message is designed to sound urgent, confidential, and routine enough to avoid suspicion.

The attacker identifies a company and key employees in finance, payroll, HR, or administration
They spoof an executive email address, use a lookalike domain, or compromise a real mailbox
They send a message that appears to come from the CEO or another senior leader
The message demands quick action and often discourages normal verification
The employee sends money, changes account details, buys gift cards, or shares confidential data

Common examples of CEO fraud

CEO fraud can take several forms depending on the target and the business process being exploited. The scam usually centers on authority and speed.

Urgent wire request: A fake executive email instructs accounting to send a same-day wire for a confidential transaction.
Gift card scam: The attacker asks an employee to buy gift cards immediately and send the codes back by email or text.
Payroll or tax record request: HR or payroll staff are asked to send W-2 data, employee records, or direct deposit information.
Vendor payment diversion: An executive “approves” a sudden banking change or urgent payment reroute.
Attorney pressure scam: A fake lawyer or executive assistant claims a deal or legal issue requires immediate secret action.

Why executive impersonation scams are effective

CEO fraud is effective because it feels personal and legitimate. Unlike generic phishing emails, these messages may be short, professional, and directly relevant to the employee’s role. There may be no attachment, no obvious malicious link, and no major spelling mistakes. Instead, the attacker uses authority, familiarity, and timing.

Employees are especially vulnerable during busy periods, travel days, end-of-quarter activity, vendor payment cycles, and times when an executive is known to be unavailable for easy confirmation. The scammer often counts on the employee being too rushed or intimidated to question the request.

Red flags of CEO fraud

Even when these scams look convincing, they often contain warning signs. Employees should slow down any request from leadership that involves money, secrecy, or sensitive records.

Unexpected urgency involving wires, gift cards, banking changes, or confidential files
Requests to bypass normal approval procedures or keep the matter secret
Email addresses that look close to the real executive domain but are not exact
Payment requests that do not fit the executive’s normal role or usual process
Pressure to act immediately when the employee asks to verify
Messages sent at unusual times or with slightly different writing style
Instructions to reply only by email and avoid calling

CEO fraud vs Business Email Compromise

CEO fraud is a type of Business Email Compromise. BEC is the broader category that includes executive impersonation, vendor invoice scams, payroll diversion, account compromise, and other trust-based attacks involving business communication. CEO fraud specifically focuses on impersonating leadership to exploit authority.

How to react to a suspicious executive request

Employees should not feel pressured to act simply because a message appears to come from senior leadership. A legitimate executive request can survive a short verification step; a fraudulent one often depends on bypassing that step.

Pause. Do not send money, buy gift cards, change banking information, or release sensitive data yet.
Verify the sender separately. Use a known phone number, internal directory, face-to-face confirmation, or an established company communication channel.
Follow normal approval procedures. Do not bypass controls because the message claims to be urgent or confidential.
Check the request itself. Confirm the amount, vendor, banking information, purpose, and timing before taking action.
Report the message internally. Alert the appropriate manager, finance contact, IT/security team, or business owner so others can be warned.

What employees can say when a CEO request feels suspicious

Verification does not need to sound confrontational. Employees can use short, professional responses that protect both the employee and the organization.

“I need to verify this request through our normal approval process before I can send the payment.”

“I’ll call you using the number in our company directory to confirm this change.”

“I can help with this once the payment or data request has been independently verified.”

How to prevent CEO fraud

Preventing CEO fraud requires more than spam filters. Businesses need clear internal controls, employee training, and a culture where verification is expected, even when a request appears to come from the top.

Require verbal or out-of-band verification for wire transfers and payment changes
Train employees to question unusual executive requests without fear of getting in trouble
Use known phone numbers or internal contact methods, not the reply details in the suspicious message
Enable multi-factor authentication on executive and finance-related email accounts
Use approval workflows for payments, payroll changes, and release of confidential records
Review email security settings, domain protection, and alerting for suspicious logins
Limit who can authorize transfers, change banking details, or export sensitive employee data

What to do if an employee falls for CEO fraud

If an employee already responded to a fraudulent executive request, speed matters. Contact the financial institution immediately if money was sent, ask about a wire recall or fraud intervention, preserve the original message and headers, alert internal leadership, and document what information, money, or account changes were involved.

Contact the bank or payment provider immediately if funds were sent or banking details were changed.
Preserve the evidence, including the original message, headers, phone numbers, invoices, payment instructions, and transaction details.
Secure affected accounts by changing compromised credentials, revoking suspicious sessions, and reviewing multi-factor authentication.
Check mailbox rules and forwarding settings if an executive or employee email account may have been compromised.
Notify affected vendors or employees if their information or payment instructions may have been exposed.
Report the incident to the FBI Internet Crime Complaint Center (IC3) when appropriate.

If payroll, tax records, or employee information were disclosed, the company should also assess applicable legal, HR, contractual, and notification obligations.

For wire-fraud response guidance, read: What to Do If Your Business Sent a Wire to a Scammer.

Frequently asked questions

What is the difference between CEO fraud and phishing?

CEO fraud is a form of phishing, but it is more targeted and usually focused on business payments, sensitive records, or approvals. It often uses impersonation and urgency instead of generic spam tactics.

Does CEO fraud always involve email?

No. Email is common, but attackers may also use text messages, phone calls, or collaboration tools while pretending to be an executive or trusted leader.

Who is usually targeted in a CEO fraud scam?

Finance staff, bookkeepers, payroll employees, HR personnel, executive assistants, office managers, and employees with access to approvals or confidential records are common targets.

Can a real executive email account be used in CEO fraud?

Yes. Some scams use spoofed addresses, but others involve a real mailbox that has been compromised, which makes the request even more believable.

What should an employee do if a CEO request seems suspicious?

Pause the request and independently verify it before taking action. Use a known phone number, internal directory, or established company process rather than relying on contact information supplied in the suspicious message.

Trusted resources about CEO fraud and BEC

The FBI treats executive impersonation as a form of Business Email Compromise and recommends independently verifying financial requests, using multi-step verification for transactions, contacting the financial institution quickly after fraud, and reporting appropriate incidents through IC3.

CEO Fraud Explained: Executive Impersonation Scams