👔
CEO Fraud
High SeverityAverage loss per CEO fraud incident: $130,000
CEO fraud is a type of BEC where attackers specifically impersonate a company's CEO or other C-suite executive to request urgent financial transactions from employees in finance or accounting.
How it works
- Attackers identify the CEO's name, email style, and key reports
- They register a lookalike domain or compromise the actual account
- An urgent email is sent to the CFO, controller, or accounts payable
- The request bypasses normal approval chains citing urgency or secrecy
Red flags to watch for
- CEO contacting you directly about a financial matter (unusual chain of command)
- Request to bypass standard approval procedures
- Emphasis on secrecy or confidentiality
- Time pressure tied to a specific event (board meeting, acquisition)
Real-world example
Subject: Quick favor needed
From: CEO Name <ceo.name@c0mpany.com>
“Are you at your desk? I need you to handle a confidential payment for a new acquisition. Can't discuss on phone as I'm in due diligence meetings. Reply here only.”
How to protect yourself
- Establish a verbal verification policy for executive requests over a dollar threshold
- Educate finance teams on CEO fraud patterns
- Use SiftMail's domain similarity detection to flag lookalike sender addresses
How SiftMail detects this
SiftMail's anomaly detection cross-references sender display names with known executive names and flags domain mismatches, protecting against impersonation at the inbox level.
Stop ceo fraud before they reach your inbox
SiftMail scores every incoming email and automatically quarantines threats. Free plan available, setup takes 30 seconds.