CEO fraud is a scam in which someone impersonates a company executive to get an employee to make a transfer, change a bank account, or hand over information. There is no need to break into any system. All it takes is a believable message, a familiar name, and an urgency that leaves no time to think.
I write this from the uncomfortable side: the executive whose name they use is me. And I am almost never the one who receives the message.
How does CEO fraud work?
There are almost always three stages. First, the attacker does research. Who signs off on payments, who the CFO is, when the CEO travels, which vendors there are, and how they write to each other. Much of that is on LinkedIn, on the company website, and in press releases.
Next, the contact. An email from an address that looks very much like the real one, or from the real one if someone has already stolen the mailbox password. A WhatsApp message with the executive's photo. Increasingly, a voice note or a call.
And finally, the pressure. A confidential transaction, an acquisition nobody can know about yet, a payment that has to go out today because tomorrow the deal falls through. Confidentiality ensures the victim does not mention it to anyone who could stop them.
How is it different from phishing?
The phishing is a net cast into the water. Thousands of identical messages and a fake link. The attacker is satisfied if a small percentage bite.
CEO fraud is a lure handcrafted for a single person. It carries real names, real transactions, and a tone that sounds like the company's own. It often has no link or attachment, so filters looking for malicious code find nothing to flag. The weapon is a request.
There is another practical difference. Phishing is fought with technology and general training. CEO fraud is fought with a procedure: an internal rule that nobody skips, not even when the person asking seems to be the boss.
Is it the same as BEC?
It is one of its forms. The FBI calls the whole family BEC (business email compromise): the impersonated executive, the vendor that suddenly changes bank accounts, the fake lawyer pressing to close a deal. Its definition also includes phone numbers and video call applications.
That is why its figures do not separate CEO fraud from the rest. What they do show is the size of the family. According to the IC3 2025 annual report, the FBI's Internet Crime Complaint Center, BEC accounted for 24,768 complaints and $3,046 million in losses during 2025. Among online frauds, only investment fraud caused more money to be lost.
These are complaints filed in the United States. What happens in Mexico does not appear there.
What changes with artificial intelligence?
Two things. The first is the writing. Emails used to give themselves away through spelling; today a text generator writes in the exact tone of a CEO. The IC3 report itself mentions this and records more than $30 million lost in 2025 in BEC cases involving artificial intelligence.
The second is voice. In May 2025, the FBI published an alert about AI-generated voice messages impersonating senior officials. It noted that a cloned voice can sound almost identical to the real one. What applies to an official applies to a CEO who gives interviews or posts videos.
The conclusion is uncomfortable: recognizing the voice no longer counts as proof.
How to read a message like this (made-up example)
“Ana, I'm walking into a board meeting and can't talk. I need a transfer to go out today to a law firm for the acquisition we're closing. It's confidential, don't mention it to anyone in the department until Monday. I'll send you the details here.”
- Cannot talk: cuts off the channel you would use to check.
- Today: urgency replaces procedure.
- Confidential: isolates the person from anyone who could stop them.
- A new account nobody has validated before.
How does a company protect itself?
The defense that works is not technological. It is an internal agreement, written and signed from the top: no transfer or account change goes out on the strength of a message, however urgent it sounds. It is confirmed through a second channel not chosen by the person asking for the money. If the email says “call me at this number,” you call the number that was already in the contact list.
That rule only holds if the CEO respects it in public. If I skip the procedure once because I am in a hurry, I teach the whole team that the boss's urgency is a valid exception. Which is exactly what the attacker needs.
Then come the technical layers. Protecting executive and finance mailboxes with multi-factor authentication, because a stolen mailbox makes the scam almost perfect. Configure SPF, DKIM, and DMARC so that nobody can send emails impersonating your domain. Review vendors, because a bank account change is the first cousin of this fraud and comes in through third-party risk.
And have it decided in advance what to do in the first hour if the money has already gone out: call the bank to try to stop the transfer, isolate the mailbox, and preserve the evidence. That belongs in a incident response playbook, not on improvisation in the moment. A SOC 24/7 helps you see what is coming earlier, such as an unusual sign-in to the CFO's email or a rule that forwards messages outside the company.
Frequently asked questions
Does it only happen to large companies?
What should I do if I receive a suspicious message from my boss?
Can the money be recovered?
Does cyber insurance cover it?
Does an internal code word help?
The rule that is worth more than any tool
CEO fraud works because nobody wants to be the person who kept the boss waiting. The solution is to take that weight off whoever receives the message and put it on a rule.
If you want to know the current state of your executive and finance mailboxes, start with the free security assessment. And if any term sounded unfamiliar, the glossary explains it.
