CEO Fraud Scam: How to Spot and Stop Impersonation
You probably have a payment approval process. It sits in a shared drive, it names two approvers, and it rests on one quiet assumption: that the person asking for money is the person the email says they are. That assumption is the target, and criminals go after it at the exact moment your process feels most confident, when the request appears to come from the top of the org chart.
CEO fraud doesn't need a server room, a zero-day, or malware hidden in an invoice. It needs a name people respect, a deadline, a reason to keep quiet, and one employee with the authority to release a transfer. Everything else is preparation.
What follows explains how the scam works, where controls usually fail, and what to change so that a convincing request still can't move money. The short version: detection tells you what you're looking at. Verification decides whether the money leaves.
What CEO Fraud Is and Why It Pays Off
The email arrives at 4:40 on a Friday. It carries the chief executive's display name, a subject line about a confidential acquisition, and a request to release a wire before the bank closes. No attachment needs opening and no link needs clicking, which is the uncomfortable part. Nothing technical has to happen for the money to leave.
CEO fraud is a form of business email compromise (BEC), in which a criminal impersonates an executive or a trusted business partner to pressure an employee into making an urgent, confidential payment. The cleanest way to picture it is a forged authorization slip delivered through the boss's own channel. You've been trained to trust the channel, so the paper looks routine even when the authority behind it is fake.
The FBI's 2024 Internet Crime Complaint Center report counted 21,442 BEC complaints and about $2.77 billion in reported US losses during 2024. That was slightly below 2023's roughly $2.95 billion, and BEC still sat among the most financially damaging categories the FBI tracks. Look wider and the picture worsens: IC3 logged 859,532 internet-crime complaints and $16.6 billion in losses in 2024, a 33% increase in total losses over 2023.
Treat those totals as a floor. Companies stay quiet to protect their reputation, and funds that reach a mule account are hard to pull back. Reported losses undercount what leaves the building.
Why the scam works without malware
Authority, urgency and secrecy do the work that malware used to do. An executive's name clears the objection before anyone raises it. A deadline of "before the bank closes" removes the time needed to check. A note that the deal is confidential removes the colleague who would have asked a question.
Then the request travels through a process you already run every day. Attackers compromise or spoof mailboxes, manipulate phone calls, and use virtual meeting tools so the instruction looks authentic from the first line. The target isn't your network. It's the person with wire authority and the habit of saying yes.
Practical rule: a payment request that arrives with its own deadline is a request to skip verification. Treat the deadline as the warning, not the reason to hurry.
Where the losses land
The US total is a sum of very different regional pictures. In 2024, Texas reported $293.5 million in BEC losses, according to the FBI's El Paso field office, while Alaska reported $4.3 million, according to the FBI's Anchorage field office. Small states lose small sums, and the mechanism is identical.
Zoom out and the trend holds. Nacha's summary of FBI IC3 data puts reported BEC losses at nearly $8.5 billion between 2022 and 2024. It isn't a US-only problem either: Switzerland's National Cyber Security Centre received 970 CEO-fraud reports in 2025, up from 719 in 2024.
That's why the useful question isn't "how do we block the email" but "what happens at the approval desk." The same request that reaches a clerk with no callback rule is a loss. Reaching a clerk with a callback rule makes it a Tuesday.
Warning Signs and Tactics at a Glance
Nearly every case carries three tells, and you can spot all three without any tooling.
- A clock that isn't yours. The request sets a deadline measured in hours, usually tied to a bank cut-off, a closing, or a flight. Real deals survive a phone call.
- A request for silence. Confidentiality, a pending announcement, a regulator, a board matter. Silence removes the second opinion that would have stopped the transfer.
- A route around the process. A new bank account, a different approver, a payment split to stay under a threshold, or a request sent to someone who doesn't normally handle wires.
Those three signs sit on top of six recurring tactics. The table is a first filter, not a complete test, because skilled criminals layer two or three of these in a single attempt.
| Tactic | What the request looks like | First check |
|---|---|---|
| Spoofed executive email | Urgent, confidential wire to a new account | Call the executive on a number already on file |
| Compromised mailbox | A real email thread suddenly asks for payment | Review mailbox rules and recent sign-ins |
| Voice-cloned phone call | A familiar voice requests an immediate transfer | Hang up and call back on a pre-registered number |
| Video-call impersonation | A senior figure appears on video and asks for funds | Confirm through a second trusted channel before any transfer |
| Impersonated recovery agent | An offer to recover money after an earlier loss, often for a fee | Verify the agency through its official published contact details |
| Supplier bank-detail change | A vendor asks to change its remittance account | Hold the payment and verify on a known number |
The fourth row deserves a warning of its own. A live video call feels like the strongest possible proof, and it's the one people cave to fastest. Treat the face on the screen as an unverified claim, exactly like the sender address.
Today's task is small. Pull the last three payment requests your team processed and score each one against the six rows. Any request that matches two or more, whether in tactic or in the three signs above, gets flagged and reviewed before the next one lands.
Deepfake Voice and Video Cases Show the Escalation
Start with France in 2021. A Franco-Israeli criminal network targeted companies by impersonating CEOs, lawyers, accountants and consultants, according to Europol's briefing on CEO fraud. One victim company lost almost EUR 38 million within only a few days. The identities weren't forged in a single email. They were built across a cast of characters the finance team thought it knew.
A second Europol case pushed the technique further. Criminals used deepfake audio to impersonate a company CEO and induced a transfer equivalent to EUR 35 million. No mailbox was hijacked to make that call. A voice was enough.
The history shows the same curve. In 2018, the FBI received more than 351,000 BEC-related scam reports with losses exceeding $2.7 billion, and BEC losses alone reached approximately $1.2 billion that year, nearly double the previous year's level, per Europol. The tactic didn't change overnight. The delivery channel did, moving from spoofed email to phone to video conference.
| Milestone | Amount | What it shows | Source |
|---|---|---|---|
| 2018 BEC scam reports | More than 351,000 reports and losses exceeding $2.7 billion | Scale of complaints the FBI received | Europol summary of FBI data |
| 2018 BEC losses alone | About $1.2 billion | Nearly double the previous year | Europol |
| 2021 Franco-Israeli network | Almost EUR 38 million | One French company lost it within a few days | Europol |
| Deepfake audio of a CEO | Equivalent to EUR 35 million | Voice cloning induced the transfer | Europol |
| UK CEO scams, first half of 2024 | £7.8 million total and nearly £50,000 average | Highest average among the scam types listed | UK Finance |
UK Finance reported that CEO scams caused £7.8 million in losses in the first half of 2024, with an average loss of nearly £50,000 per case, the highest average among the scam types it listed. Averages matter here: these aren't only nine-figure outliers. The typical case is large enough to hurt a mid-sized company badly.
The shape of the pattern
Three things repeat across these cases. The fraud escalates channels rather than starting at the most convincing one. It hangs on an apparent deal or deadline that justifies speed. And it leans on a familiar face or voice to carry the instruction past the point where anyone would normally ask for proof.
If you're building a response playbook for a suspected deepfake fraud attempt, write the rule in the negative: a recognizable voice or face is not evidence of authority. Authority is a person you reached on a number you already trusted, before the request existed.
Controls That Stop a Fraudulent Payment Request
Nine controls, one procedure, two jobs. The first four make it harder for anyone to issue a convincing instruction from inside your company. The last five decide what happens when a convincing instruction arrives anyway.
Phishing-resistant authentication is the highest-value fix for the account stage. NIST's guidance on multi-factor authentication notes that ordinary one-time passwords and SMS codes can be phished, while FIDO authenticators used with the W3C Web Authentication API provide phishing-resistant authentication, and NIST recommends enforcing or offering such authenticators for sensitive information and users with extensive privileges.
Phase one protects the account
- Require phishing-resistant authentication on every payment-capable account. Hardware security keys or platform passkeys for executives, finance staff, administrators, and anyone able to approve a payment. A stolen password stops being enough to send an instruction in the boss's name.
- Enforce DMARC on your corporate domains. NIST also recommends email authentication technologies that verify message origin and can reject spoofed messages. Before you change anything, verify your DMARC policy to see whether your domain is rejecting spoofed mail or only monitoring it.
- Disable legacy authentication. Old mail protocols skip modern sign-in checks entirely, so one forgotten mailbox becomes the way in.
- Monitor mailbox rules and unusual access, and apply conditional access based on device and location risk. A forwarding rule that copies an executive's mail to an outside address is the classic precursor to a fake thread.
Phase two protects the money
These five steps are what remain when the attacker never touches your systems at all.
- Make an independently initiated callback mandatory. Above a set threshold, someone calls the requester on a pre-registered number, never one supplied in the message. This single rule defeats spoofed email, hijacked threads and cloned voices in one move.
- Confirm through a second trusted channel. A chat message to a known account, a walk to the next desk, a question only that person could answer. One channel can be faked. Two rarely are, and the second check is cheap.
- Require dual approval from outside the requester's reporting chain. If the same person can approve and release, you don't have dual control. You have a signature and a formality.
- Hold new or changed bank details. A cooling-off period on beneficiary changes catches the supplier-fraud variant, where the invoice is genuine and only the account number is new.
- Cap the transaction. Limits force a second conversation on large sums. Most fraud depends on speed and volume, and a cap interrupts both.
These payment checks matter because account controls can't cover everything. A criminal can clone a voice or build a face without ever compromising a mailbox, and the social engineering attack patterns behind that approach target people rather than infrastructure.
Test it while nothing is at stake. Run the callback on one routine, non-urgent transfer this week, time how many minutes it adds, and write both the dual-approval rule and the hold period into the policy so nobody has to improvise on a Friday afternoon.
Using Detection Tools Without Trusting Them Blindly
A recording reaches your team. Someone saved the video call, a supplier sent an audio message, or a journalist uploaded a clip for verification. The question in the room is whether it's real, and a detector answers a narrower version of that question: how much of this file looks synthetic.
What a detector examines is concrete. Frame-level artifacts left by generators, audio irregularities and spectral anomalies, motion and temporal consistency across the clip, and metadata that doesn't fit the claimed origin. If you want the mechanics behind those signals, what deepfake detection measures walks through how they combine into a single result. The output is a confidence score, not a verdict, and the distinction is the whole point.
Two failure modes cut in opposite directions. A heavily compressed but authentic recording can throw up false signals, and a technically convincing synthetic clip can still be carrying a fraudulent instruction. Neither problem is solved by staring harder at the pixels.
The amount at stake keeps growing. The FBI says AI can be used to create official-sounding executive messages and clone voices for wire-payment requests, and businesses reported more than $30 million in 2025 losses from BEC scams involving AI, per the FBI's 2025 IC3 report. That report also logged 22,364 AI-related complaints with adjusted losses of $893,346,472.
The evidence routine that survives scrutiny
Most guidance stops too early. Proving what happened after a detection matters as much as the detection itself, especially for a newsroom, a legal team, or an enterprise that has to explain a decision months later.
- Keep the original file, untouched. Don't re-encode, trim, or export a copy for sharing. Hashing the file and recording the hash with a timestamp shows it hasn't changed since review.
- Capture the surrounding context. Metadata, a full transcript, the email headers or chat log that delivered it, and the claimed identity of the speaker.
- Log the detector output with its timestamp and operator. A score with no time, name, or tool version attached is hard to defend later.
- Write down who reviewed it and when. Chain of custody is a one-line habit until the day it's the only thing standing between you and a bad explanation.
- Set the escalation threshold in advance. Decide which score triggers a callback and a payment hold, and write it into the procedure rather than deciding under pressure.
Here's the practical sequence we'd suggest: screen the file, produce a repeatable time-stamped result without retaining the upload, then pair that result with independent checks, which means the callback, the hold and the second approver. The detector tells you what you're looking at. The controls decide what you do about it.
One extra habit costs a minute. If a still frame from a supposed executive circulates as a profile photo, a reverse image search can show where else that face has appeared and whether it belongs to someone with no connection to your company.
A single score is one auditable signal in a layered process, and that's the right weight for it. The use cases we list for AI Video Detector include viral misinformation, impersonation deepfakes, travel scams, dating safety, fake listings and identity fraud, which maps closely to the situations finance and legal teams face. Our screening runs on frame analysis, audio forensics, temporal consistency and metadata inspection, and returns a confidence score, but the score never replaces the callback rule. It informs it.
Recovery Scams and How to Verify Any Contact
Spotting the fake clip is the easy part of the story people tell. The harder truth is that a company which has already lost money becomes a target again, because now the criminals know the name, the amount and the person who signed off.
The FBI's July 2025 warning describes exactly that pattern. Between December 2023 and February 2025, the Bureau received more than 100 reports of scammers impersonating IC3 personnel, and the criminals allegedly targeted people who had already lost money by promising to recover it, according to the FBI alert on IC3 impersonation. Swap the costume and the same script works on a company: a senior investigator, a bank fraud liaison, a recovery agent with a case number and a small up-front fee.
A familiar face is not authority. Authority is a number you already had on file before the message arrived.
Verification follows one rule with no exceptions. The contact details you use must come from somewhere other than the message offering help. Pull the bank's number from the card or the statement, find the agency's published contact page yourself, and confirm the person's role before you share account details or pay anything.
The reset to run after an incident
- Freeze or delay all transfers until the approval trail has been rechecked, including anything queued for the next payment run.
- Call the bank's fraud desk on an independently verified number, then follow up in writing so the instruction to recall or flag the payment is documented.
- Invalidate compromised credentials and sessions, review mailbox rules, and re-enrol devices for anyone who approved the original transfer.
- Report through official channels you found on your own. File with the FBI Internet Crime Complaint Center using a browser address your company already trusts, never a link or case ID handed over by the person offering recovery.
- Require fresh out-of-band verification for every recovery claim. No fee, no screenshots, no account details before the original transfer record, the beneficiary account and the approving manager have all been rechecked.
The reason this discipline matters is that criminals can reuse publicly available executive footage, social profiles and details from the first incident to build credibility across email, messaging, voice and video. A real video can be repurposed in a fraudulent context, and a synthetic clip may be only one component of a longer chain. Refusing to trust a familiar face without independently authenticated authority is the safeguard that holds when the media itself is genuine.
Confirm Payment Controls This Week
Five days, five owners, five written outputs. A policy nobody has tested is a document, not a control.
- Day one, finance lead. List everyone who can initiate or approve a payment, then mark every role that can release a wire alone. That list is your real attack surface, and it's usually shorter and more senior than people expect.
- Day two, same owner. Review payment requests from the last 90 days against the six-tactic table. Flag anything that matched two or more signs, and pay attention to secrecy, same-day deadlines, and first-time bank accounts.
- Day three, IT. Confirm phishing-resistant authentication for executives, finance staff and administrators. Confirm DMARC enforcement is rejecting spoofed mail rather than observing it, and confirm legacy authentication is off.
- Day four, finance. Run the callback once on a non-urgent transfer and record how many minutes it takes. Then write the dual-approval rule and the cooling-off hold for changed beneficiary details into the policy.
- Day five, incident owner. Set the media-score escalation threshold, name who can place a payment hold without asking permission, and file the bank's fraud-desk number and the official reporting path where people can find them during an incident.
The week is done when each owner has a written result, not a verbal assurance. Write the results into one page and date it.
Start with the next payment request that lands in your inbox, even the boring one. Call the requester on a number you already had, time how long it takes, and note what the extra five minutes would have caught. If a video or audio file is part of the request, screen it with AI Video Detector first: upload the clip, get a confidence score in under 90 seconds with no signup required for basic detection, and keep your file private because uploads aren't stored. Then pick up the phone anyway. The detector tells you what the file is. The phone call is what stops the transfer.