CEO fraud is one of the most profitable types of fraud against organisations. The attacker pretends to be the managing director, the chair of the board or a well-known supplier, and asks someone in the finance team to pay an invoice quickly and discreetly. It requires no advanced technology. It only requires one person to act under time pressure.
How a typical attack unfolds
Fraudsters often do thorough groundwork. They find names, roles and email formats on the organisation's website and on LinkedIn. They keep track of when the manager is travelling or in meetings, because that makes it harder to double-check.
Then the email arrives. It is short, polite and urgent: "I'm in a meeting and can't talk, but this payment has to go out today. Keep it between us for now." The sender address looks like the real one, but one character has been changed. Or it comes from a genuine but hijacked account at a supplier.
A common variant is invoice fraud: a familiar supplier "changes bank" and asks for the next invoice to be paid to a new account number. The invoice looks completely normal.
The warning signs to look for
- Urgency: "This needs to be sorted before lunch."
- Secrecy: "Don't talk to anyone about this yet."
- Bypassing the routine: the request skips the normal approval process.
- A new account number for a supplier you have used for years.
- A sender address that is almost right, for example edeam.no instead of edean.no.
- An unusual tone or language, although AI has made this sign weaker.
Now with AI voices and deepfakes
A phone call used to be a safe way to confirm a payment. Not any more. With AI, a fraudster can create a convincing copy of a manager's voice from a short clip online, such as a talk or an interview. There are also examples of video meetings where "the management" was fake.
This means the control has to sit in the routine, not in how genuine the request appears.
Routines that actually stop the fraud
1. Fixed confirmation on a known number. Every change of account number and every unusual payment is confirmed by calling a phone number you already have – never the number in the email or on the invoice.
2. Two people approve. Payments above a set limit require approval from two people. No one, not even the managing director, can request an exception by email.
3. A code word for urgent cases. Some organisations agree on an internal code word that must be used for urgent payments. Fraudsters don't know it.
4. Two-factor authentication on email. Many attacks start with a hijacked email account. Two-factor makes that much harder.
5. Short, annual training. Everyone who handles payments should know the signs and the routines. The training should include real examples and an exercise.
It isn't rude to check. A real manager is glad the routine is followed.
What should you do if it has happened?
Contact the bank immediately – the faster you act, the better the chance of stopping the transfer. Report it to the police, and alert the supplier if their account was used. Review what happened and adjust the routines, without blaming the person who was tricked.
Summary
CEO fraud exploits trust, urgency and secrecy. Technology alone won't stop it, but fixed routines will: confirmation on a known number, two people approving, and employees who know what to look for. We practise recognising these attacks with real examples in our workshop Phishing and fraud.