CEO fraud is an email scam in which a criminal poses as the managing director or another senior executive and asks someone in finance or purchasing for an urgent, confidential payment, gift cards or sensitive data. It exploits authority and time pressure rather than a technical flaw. The strongest defence combines email screening that flags the impostor with a stated reason and a firm rule that payment instructions received by email are verified through another channel.
Key takeaways
- CEO fraud is the executive-impersonation form of business email compromise (BEC); its usual targets are accounts staff, finance teams and executive assistants.
- According to the FBI IC3 2025 report, 24,768 BEC complaints in the US reported losses of $3.05 billion.
- Typical signs: urgency, a demand for secrecy, an executive who "can't be reached", an unusual payment method and a display name that does not match the real address.
- Lasting protection has three layers: domain authentication with impersonation detection, a written payment verification rule and staff awareness.
- If money has already gone, minutes count: call the bank first, then preserve the evidence and report it.
How does CEO fraud work?
It usually starts with a short message: "I'm in a meeting and can't talk. We're working on a confidential acquisition and I need you to make a transfer today." The display name shows the managing director, but the address is either a free webmail account or a lookalike domain one letter away from yours. Sometimes the executive's real mailbox has been taken over, and the email genuinely comes from your own server.
The fraudster researches first: the website, LinkedIn and press releases reveal who reports to whom and when the boss travels. The request nearly always takes one of three forms: a transfer to a new account, a bulk purchase of gift cards, or a copy of staff salary details or the payroll file. We cover the supplier version of the same trick in our guide to bank detail change email fraud.
What does CEO fraud cost a business?
These attacks are far more expensive than a typical phishing attempt, because the outcome is money leaving the account, and it cannot always be recovered.
According to the FBI's Internet Crime Complaint Center (IC3), 24,768 business email compromise complaints in the US reported total losses of $3.05 billion in 2025, making BEC the crime type with the second-highest reported losses after investment fraud. (FBI IC3 2025 Internet Crime Report)
The sums are growing too. Fortra data in APWG's Phishing Activity Trends Report for Q2 2026 show that the average amount requested in wire-transfer BEC attacks rose to $61,732, and gift cards were the most common payment request at 54%.
Hidden costs follow: explanations to auditors, time with the bank, a distressed employee and damaged supplier trust. If personal data such as a payroll file has leaked, the incident also becomes a data breach, which brings notification duties under data protection law, including Turkey's KVKK.
How can you tell a fake executive email?
No single sign proves fraud on its own, but when several appear together it is time to stop and verify. The table below is a short checklist that can sit on the finance team's desk. For general warning signs, see our guide on how to spot phishing emails.
| Warning sign | Example | What to do |
|---|---|---|
| Display name and address don't match | "John Smith" shown, free webmail address behind it | Expand the full address and read the domain letter by letter |
| Lookalike domain | yourfirm.co.uk becomes yourflrm.co.uk | Compare it with the address saved in your contacts |
| Different reply-to address | Hitting Reply fills in another address | Don't reply; start a new email or phone instead |
| Urgency and secrecy | "Keep this between us, it must be done today" | A request for secrecy never removes the need to verify |
| Executive unreachable | "In a meeting, don't call" | Call the known number anyway |
| Unusual payment method | Gift cards, a new overseas account | Methods outside the payment policy are stopped automatically |
| Bypasses the normal process | Direct instruction that skips the approval chain | Route it through normal purchasing and approval |
An email sent from the executive's real, compromised account will show none of the address-based signs in this table. In that case the verification rule and behavioural cues are your only protection; for the first steps after a takeover, read compromised email account: the first 24 hours.
How do you prevent CEO fraud?
Prevention comes from a written rule backed by the right infrastructure. Here is a realistic order for a small or mid-sized business.
- Protect your domain: set up SPF, DKIM and DMARC and move your DMARC policy from monitoring towards quarantine or reject over time. This makes exact spoofing of your own domain much harder.
- Write a payment verification rule: every new payment, change of bank details or gift card request received by email is confirmed by a call to a number already on file. Have the managing director sign it, so staff never feel they are "questioning the boss".
- Use dual approval: above an agreed amount, the person who receives the instruction and the person who authorises the payment must be different.
- Use email that flags impersonation with a reason: a spam filter will not stop a technically valid message, so you need a system that separately checks display-name impersonation, lookalike domains and reply-to mismatches.
- Review what is public: organisation charts, executives' travel posts and finance staff's direct addresses are raw material for the fraudster's script.
- Train with real examples: run short, regular exercises rather than one annual presentation; our security awareness training programme guide explains how to set one up.
To see all of these controls in one place, use our SME cyber security checklist.
What should you do in the first hours if money has been sent?
Speed is everything. The FBI IC3 report stresses that "time is of the essence" once a fraudulent transfer is discovered, and notes that its Recovery Asset Team froze 58% of the attempted amount in the cases it handled in 2025.
- Call your bank straight away and ask it to stop and recall the transfer, and to alert the receiving bank.
- Do not delete the email; keep it with its headers and the full thread.
- Tell management and IT; the executive's account may be compromised, so change the password and sign out all sessions.
- Report the crime to the police or the public prosecutor's cyber crime unit.
- If personal data has leaked, assess your breach notification duties with your legal adviser.
How does SmartMail make this easier?
SmartMail is Digital Bridge's AI-assisted business email service in the Smart360 family, and it brings the layers above together against fake executive emails. Every incoming message goes through three groups of checks: SmartMail recalculates SPF, DKIM, DMARC and PTR itself rather than trusting a result written by another server; it separately checks for lookalike domains, international-character (punycode) spoofing, brand and display-name impersonation, and reply-to or link mismatches; and AI assesses the full text of the message.
Take a concrete scenario. On a Friday afternoon, the accounts lead receives an email from a free address, signed "Managing Director", asking for an urgent transfer. SmartMail shows a risk badge next to the sender's name; clicking it lists each signal that raised the risk, such as the display name imitating a company executive and a different reply-to address. A message below the trust threshold never reaches the inbox at all, and waits in quarantine with its reason instead of being deleted.
If the accounts lead is unsure about a message, they can use "draw attention" to alert a finance manager who has access to the same mailbox, without forwarding it. A warning such as "payment instructions are confirmed by phone only" can be attached as a team note, which the recipient never sees, to a person or an organisation, and it appears on later emails from that source. An outgoing payment confirmation sent on the company's behalf can go through "Send with approval" to a second person, with every decision logged with date and time. Administrators set the quarantine threshold and "always quarantine" sender rules; full details are on the SmartMail product page.
SmartMail's SPF, DKIM, DMARC and lookalike-domain checks are rule-based, so this protection keeps running even when the monthly AI allowance is used up.
How can Digital Bridge help?
Through our cyber security consultancy we design your payment verification rule, approval chain and role-based mailbox access with you. When you move to SmartMail, the Smart360 team prepares and verifies the MX, SPF, DKIM and DMARC records, and migrating your old emails during initial setup is free of charge. If you want SmartMail and SmartFiles under the same identity, the Smart360 product family gives you a single panel.
Next step: when should you act on CEO fraud?
The cheapest thing you can do this week is write the payment verification rule and get the managing director to sign it. Then check your domain's DMARC status and whether your finance team's inbox flags display-name impersonation with a stated reason. All our security and data protection articles are collected in the Security and KVKK guide.
To start using SmartMail on your own domain, choose your number of mailboxes on the Smart360 purchase page. To explore the features first, visit the SmartMail page, or ask us to review your current setup via our contact page.