CEO scam (or CEO fraud)

The CEO fraud is a social engineering attack in which a cybercriminal impersonates a company executive to manipulate an employee—usually from the finance department—and persuade them to make a wire transfer or disclose sensitive information under the pretext of urgency and confidentiality.

Definition and Principles of the CEO Fraud Scheme

According to CERT-FR andANSSI, the CEO scam (also known as Business Email Compromise or BEC fraud) involves impersonating a senior executive (CEO, CFO, general counsel, etc.) to convince an employee to carry out an urgent and confidential financial transaction.
The attacker poses as a legitimate authority figure and exploits the hierarchical structure to create a climate of psychological pressure.

Typical Attack Pattern

  1. Information gathering: The cybercriminal collects publicly available data (websites, social media, press releases, internal organizational charts).

  2. Identity Theft : He forges an email address that is similar to that of the executive or business partner (e.g., pdg@domaine.com instead of pdg@domaine.fr).

  3. Fraudulent message: The scammer contacts a targeted individual, citing urgency and confidentiality.

  4. Emotional manipulation: The tone is directive, complimentary, or threatening, depending on the victim's profile.

  5. Transfer or disclosure: The victim carries out the requested action without verifying it, believing they are following a legitimate instruction.

Specific examples of attacks

  • An SME receives an email purportedly sent by its CEO, who is traveling abroad, requesting an urgent “strategic” wire transfer.

  • A fake lawyer contacts the finance department regarding a “confidential merger and acquisition deal.”

  • A chief accountant is pressured to transfer several hundred thousand euros to an overseas account before it has been verified.

According to ENISA, these attacks result in losses of several hundred million euros each year in Europe, which are often impossible to recover once the funds have been transferred.

Warning Signs of an Attempted CEO Fraud Scheme

  • Slightly modified email address or domain name

  • An unusual tone that emphasizes confidentiality or urgency

  • Lack of a standard internal validation process

  • Request for an International Wire Transfer or a Change of Payee

  • Refusal to engage in direct telephone conversations

These indicators should immediately trigger an internal alert to the security department or the cybersecurity team.

Why are these attacks still successful?

The CEO scam exploits the human element of cybersecurity. Unlike a technical breach, it bypasses digital defenses by relying on psychological manipulation.
Even the most secure systems remain vulnerable without a cybersecurity culture that is firmly embedded within the organization.

Recommended Preventive Measures

1. Raising Awareness and Training Teams

Phishing simulation and cyber awareness campaigns are essential. Employees must be able to identify phishing attempts and respond calmly.

2. Enhanced validation procedures

Any exceptional request to transfer or share sensitive data must be double-checked, particularly through a different channel (phone call, internal messaging).

3. Technical Security

  • Multifactor Authentication (MFA)

  • Monitoring Similar Domains (Typosquatting)

  • Anomaly Detection in Financial Flows

  • Advanced email filtering (anti-spoofing, SPF, DKIM, DMARC)

4. Monitoring and Incident Response

Implementing a SOC (Security Operations Center) or a behavioral detection solution such as ITrust’s Reveelium makes it possible to identify suspicious behavior in real time and block risky operations.

Protect your business from CEO fraud with ITrust’s expertise.