Skip to main content

Wolfcore Cyber Security

Try our phishing simulations free for 14 days. Start free trial →
Get Started

What is CEO fraud? How fake-boss payment scams work and how to stop them

Category hub: Social engineering and human risk

In one sentence: CEO fraud is when a criminal pretends to be your boss, by email or phone, and tells someone in finance to make an urgent payment to the criminal’s bank account.

What it is

CEO fraud is a form of business email compromise. A criminal poses as a senior person, such as the chief executive or finance director, and asks an employee to move money. The request is urgent and secret.

The FBI’s Internet Crime Complaint Center describes the pattern. A senior executive’s account is compromised or spoofed, and a wire transfer request goes to a second employee who normally processes payments. The FBI notes the scam has also been called “CEO Fraud”, “Business Executive Scam” and “Masquerading”.

How it works

  1. The criminal studies the target. The FBI says victims are watched and studied with social engineering first.
  2. They look like the boss, through a hacked mailbox or a spoofed address. The FBI gives the example of one letter changed, such as .co instead of .com.
  3. They pick a payer, often a junior finance employee who will not question a director.
  4. They press for speed and secrecy, often with a story about a confidential acquisition.
  5. The money is wired abroad and moved on. The FBI says the window to recover funds is extremely short.

Who it affects and how badly

  • Sole trader to 10 staff. One person does everything, so one fake message from a partner can empty the account.
  • 10 to 250 staff. Accountancy and legal practices, recruiters, estate agents and construction firms move large sums for clients. A diverted payment can mean repaying a client from your own funds.
  • 250 plus and regulated firms. Finance teams are targeted by role. Fintech and insurers must also consider regulator and insurer reporting, and management accountability.

The FBI says businesses of all sizes are targeted.

Real examples

  • FACC, Austria. On its own news page the aircraft parts maker calls it the “Fake President Incident” and says it fell victim to fraud at the end of 2015. About EUR 10.8 million was frozen in Chinese accounts in early 2016 through cooperation between Chinese and Austrian authorities. The funds were returned to FACC at the end of March 2025, after about six years of proceedings. SecurityWeek reported the original loss at some 50 million euros.
  • FBI case file. An accountant spotted a fake CEO email after a phone call. The first message had .co in place of .com, and the signature on an attachment was forged.

How to detect it

  • Payment requests by email only, marked urgent or confidential, that skip the usual approval chain.
  • Sender addresses a letter away from the real one.
  • In Microsoft 365, new inbox rules or forwarding on executive mailboxes. In Google Workspace, new forwarding or filters on executive accounts.
  • Executive sign-in alerts from unusual places.

How to fix or prevent it

  1. Require a call-back, to a number you already hold, before any new payment or changed bank details is actioned.
  2. Require two people to approve payments above a limit you set.
  3. Add an external sender banner in Microsoft 365 or Google Workspace.
  4. Set up SPF, DKIM and DMARC on your own domain so criminals cannot spoof it.
  5. Turn on MFA for every mailbox, starting with executives and finance.
  6. Tell finance staff they will never be blamed for checking.
  7. Include payment requests in phishing simulations.
  8. If it happens, contact your bank at once to ask for a recall, then report it to the police.

Related terms

FAQ

What is the difference between CEO fraud and BEC?
CEO fraud is one type of business email compromise, where the criminal pretends to be a senior executive.

Who should check a payment request from the boss?
A second person, using a number already on file. The FBI advises verifying changes by phone.

Can the money be recovered?
Sometimes, but the FBI says the window is extremely short, so contact the bank immediately.

Sources

How Wolfcore helps

Phishy runs realistic phishing simulations against your own staff and shows you who clicked, so you can train the people attackers target. See Phishy phishing simulation.