CEO Fraud: How It Works and How to Stop It

CEO fraud is a scam in which a criminal poses as a company's chief executive, by email, phone or a faked video call, and pressures an employee into wiring money or sending sensitive data to an account the criminal controls. It is a form of business email compromise (BEC), which the FBI's Internet Crime Complaint Center counted at 21,442 complaints and $2.77 billion in reported losses in 2024. The attack needs no malware: it exploits authority, urgency and secrecy. This guide explains how the scheme runs, what a CEO fraud email looks like, which supporting files can be checked like any other case of document fraud detection, and what to do in the first hours after a wire.

CEO fraud at a glance

The table follows the four stages of a typical CEO fraud attack, as described in FBI and industry case reports: what the criminal does at each stage, and the signal an alert accounts payable employee can catch before the money leaves.

What is CEO fraud?

CEO fraud, also called executive impersonation or whaling when the target is senior, is the variant of business email compromise where the impersonated person is the company's own leader. Other BEC variants impersonate a vendor that "changed banks", an employee who wants their paycheck redirected, or a title company in a real estate closing. What they share is a false identity used to make the victim pay willingly, which is why the money is so hard to recover: the bank sees a payment the company itself authorized.

The numbers explain why the scheme persists. In the FBI's 2024 Internet Crime Report, BEC ranked second by dollar losses, behind investment fraud, with $2,770,151,146 in reported losses, after $2.95 billion in 2023. Those figures only cover complaints filed with IC3, so the real total is higher.

How does a CEO fraud attack work?

Published cases follow the same four steps almost every time. Knowing them lets a finance team stop the attack at the cheap stage, before a wire is approved.

Research

The attacker maps the company from public sources: the CEO, CFO and controller on LinkedIn, an acquisition announced in a press release, the CEO's travel schedule posted on social media, an email signature lifted from a routine exchange. A call to the front desk to "update vendor records" can reveal who releases payments.

First contact

The fake CEO writes from a lookalike domain, one swapped letter or an extra hyphen, or from a compromised mailbox. The message announces a confidential deal and warns that an attorney or auditor will follow up. That second contact, run by the same crew, makes the first one more believable.

Pressure

The employee is flattered as the only person who can be trusted, then rushed: the wire must go out before close of business, the CEO is in meetings and cannot take calls, nobody else may know. Secrecy is the point, because it switches off dual approval, the one control that would stop the payment.

Payment and paperwork

To get through accounts payable, the fraudster supplies documents: a letter on a law firm's letterhead, an invoice for consulting work, wiring instructions for a shell company, sometimes a fake certificate of good standing. The funds land in a mule account and are split and moved within hours.

What does a CEO fraud email look like?

A CEO fraud email is short, informal and urgent, and it usually arrives when the real executive is hard to reach. A typical first message, with names changed, reads: "Are you at your desk? I need you to handle a confidential payment for an acquisition today. Our counsel will email you the details. Please keep this between us until the announcement." The warning signs:

• a sender address that is close to the real one, or a reply-to address that differs from the sender;
• a request to keep the payment from the CFO, the controller or anyone else;
• a new payee, or a known vendor suddenly using a new bank, often abroad;
• an amount that sits just under the dual signature threshold;
• a refusal to talk by phone, or a call that comes from an unknown number.

Which documents back up a CEO fraud request?

CEO fraud starts with a message, but it almost always ends with a document. These files are produced quickly, from templates or genuine documents that have been edited, and they leave traces that can be read before anyone pays.

A fake vendor invoice is the most common, and the core of invoice fraud: the logo and layout of a real supplier with altered bank details. Recalculating totals and tax, comparing the invoice with earlier ones from the same vendor and confirming the account through a known contact usually expose the gap. Our guide to invoice fraud detection covers each of those checks.

A fake letter from counsel or from a bank usually arrives as a PDF, and the file often tells a different story from its content. A letter supposed to come from a law firm may have been created the day before in consumer word processing software, or carry traces of several successive saves. A pdf metadata viewer shows the producing software and the creation and modification dates in seconds; it gives a first indication, never proof on its own.

Corporate paperwork for the payee, such as articles of incorporation or a certificate of good standing, should be checked against the state registry rather than accepted from an email attachment. A dedicated company verification step before a new payee is added closes that gap.

Deepfakes: voice and video are no longer proof

In January 2024, an employee at the Hong Kong office of engineering firm Arup made 15 transfers totaling 200 million Hong Kong dollars, about $25.6 million, after a video call in which the CFO and several colleagues were AI generated imitations built from public footage. The employee had first suspected a phishing email; the video call convinced them. Arup confirmed it was the victim in May 2024 (CNN, May 16, 2024). The practical lesson: any confirmation obtained on a channel the requester opened is worthless, even when the face and the voice are right.

How to prevent CEO fraud

Prevention rests on a few written rules that everyone in finance knows and nobody can waive, followed by a check of the paperwork. Technology helps, but these procedures stop most attempts on their own.

Call back on a known number

Confirm every unexpected payment request by calling the requester on a number taken from the company directory or the vendor master file, never one given in the email or by the caller. The rule applies to video calls too: hang up and call back.

Dual approval with no exceptions

Require a second approver for any new payee, any change of bank details and any wire above a set amount, and state in writing that the CEO cannot ask for the rule to be skipped. That one sentence defeats the secrecy argument.

Email authentication

Publish SPF, DKIM and DMARC records with an enforcement policy, flag external senders and lookalike domains in the mail client, and turn on multi factor authentication for every mailbox, so an attacker cannot send from a real executive account.

Check the documents before payment

An invoice or a set of wiring instructions that arrives alongside an urgent request should be handled as a high risk document: consistent amounts, the vendor's history, the payee's legal existence, traces of editing in the file. This check adds a second layer when the voice on the phone was convincing.

What to do if you already wired the money

Speed decides the outcome, because the funds move from account to account within hours. The steps below combine standard incident response with the FBI's IC3 reporting process and its Recovery Asset Team:

• call your bank immediately, report the wire as fraudulent and ask it to recall the funds and contact the receiving bank;
• file a complaint at ic3.gov with the transaction details, which can trigger the FBI's Financial Fraud Kill Chain;
• list every payment sent, pending or scheduled to the fraudulent account and block it in your systems;
• keep the evidence: emails with full headers, phone numbers, invoices and wiring instructions;
• if a mailbox was compromised, reset its password, review forwarding rules and enable multi factor authentication.

Acting fast pays off. According to the 2024 IC3 report, the Recovery Asset Team handled 3,020 Financial Fraud Kill Chain requests covering $848.4 million in attempted theft, and froze $561.6 million ($469.1 million domestic, $92.5 million international), a 66% success rate.

How we researched this guide

This guide draws on the FBI's 2024 Internet Crime Report (IC3), its Recovery Asset Team figures, and the Arup case as reported by CNN. Sources were checked on November 2, 2026. The top ranking pages on the topic were read in full to see what they cover and what they miss, in particular the documents that carry the fraud.

Frequently asked questions

What is CEO fraud?

CEO fraud is a scam in which a criminal impersonates a company's chief executive to get an employee to send a wire or sensitive data to an account the criminal controls. The FBI tracks it as part of business email compromise.

Is CEO fraud the same as business email compromise?

CEO fraud is one type of business email compromise. BEC also covers vendor impersonation, payroll diversion and real estate wire fraud. BEC as a whole caused $2.77 billion in reported losses in the US in 2024, according to IC3.

What are CEO phishing attacks?

CEO phishing, or whaling, uses messages that appear to come from a senior executive, or that target one, to obtain a payment, gift cards, payroll data or login credentials. The defense is the same: verify on a known channel before acting.

Can you get money back after CEO fraud?

Sometimes, if the bank and IC3 are alerted within hours, before the funds leave the receiving account. In 2024 the FBI's Recovery Asset Team froze funds in 66% of the Financial Fraud Kill Chain cases it handled.

Is a video call with the CEO enough to confirm a payment?

No. The 2024 Arup case showed that an entire video meeting can be faked with AI. Only a callback that the employee initiates, on a number they already have, confirms a payment request.