Imagine it is Friday afternoon and someone in the finance team gets an email from the CEO: a transfer has to go out today, it is confidential, and they must not tell anyone until it is done. The boss is travelling, is not answering the phone, and the message stresses that it is urgent. Plenty of people would pay. That is CEO fraud, and it works precisely because it does not rely on any technical flaw.

◢What is CEO fraud and how does it work?

It is also called CEO scam, director fraud or executive impersonation. The attacker pretends to be someone with authority, usually a CEO, a chairman or a director, and asks someone who can make payments to do so.

Before writing, attackers usually do their homework. INCIBE explains that they research the company: the org chart, email addresses, suppliers, when the bosses are on holiday, what is posted on social media. In many cases they watch the mailbox for weeks and strike when an important invoice is expected or when the executive is away.

The message leans on three levers: urgency, secrecy and fear of letting down a superior. None of them needs a single line of malicious code.

◢What are the warning signs of CEO fraud?

Some patterns repeat, and INCIBE lists them:

• ▹An urgent payment that falls outside the usual procedure.
• ▹A request not to tell anyone, with phrases like "this payment is confidential".
• ▹Insistence on leaving the normal channel, for example moving from email to WhatsApp.
• ▹A sender with a domain close to the real one, with a letter changed or a different ending.

No single sign proves anything. Together, they should make you stop.

◢What variants are there?

The boss asking for a transfer is the best known version, but INCIBE describes more:

• ▹Payment with gift cards, cash deposits or cryptocurrency ATMs.
• ▹Whaling, aimed at senior executives.
• ▹The so-called intern attack, aimed at newcomers who do not yet know the procedures.
• ▹BEC fraud (business email compromise), where the bank account on a genuine invoice is swapped.
• ▹Voice or video impersonation of an executive using artificial intelligence.

That last one deserves attention. If a call with the manager's voice can be fake, a familiar voice is no longer enough as a check. Verification has to rest on a procedure, not on a feeling.

◢Why do sharp people fall for it?

Because the victim is not careless, they act reasonably with the information they have. The person paying believes they are obeying their boss, that the rush is real and that asking questions would be a mistake. And the attacker has picked a moment when nobody can contradict the story.

It is similar to what I see when I look at how attackers get into a company: they almost always start with a person, not a server. I wrote about it in attacks don't come in through the server.

◢How to prevent it in your company

INCIBE proposes ten measures. These are the ones that work best for a small business:

• ▹Verify any urgent transfer through a different channel from the one the request came in on, using a phone number you already have and not the one in the message.
• ▹Check the sender's domain letter by letter.
• ▹Require two approvals above an amount you set.
• ▹Define how a new account is added and how an IBAN is changed, and always confirm that change with the supplier through another route.
• ▹Limit public information about executives, schedules and internal processes.
• ▹Distrust urgency and secrecy, even when the message seems to come from who it says it does.
• ▹Use email filters that detect look-alike domains.
• ▹Keep the incident response plan up to date.

One detail helps a lot: the person who pays should know they have explicit permission to doubt. If asking management about a payment is costly in your company, the fraud has already won half the battle.

◢What if the payment has already gone out?

Time matters. INCIBE says to contact the bank immediately, report it to the Police or the Guardia Civil, and call the cybersecurity helpline, 017, which is open from 08:00 to 23:00 every day of the year (this line serves Spain).

Tell people inside the company too. Whoever paid often feels ashamed and takes a while to say so, and those hours are the ones that do the most damage.

◢Can you train your team for this?

You can, and it is the best return on effort. A written rule nobody has rehearsed is forgotten as soon as a convincing email arrives. What works is practising real scenarios: what do I do if management emails me asking for a payment, who do I call, what do I say.

It is one of the topics I cover in my cybersecurity and AI training for companies, designed for teams that are not technical.