Fraud · Appelez le tech
An email from the “president” asks for an urgent, confidential wire transfer. The tone is right, so is the signature, and the money goes out. CEO fraud doesn’t hack your systems: it hacks trust and hierarchy. It’s one of the costliest frauds for businesses, and AI is making it more convincing than ever.
What is CEO fraud?
Also called “fake executive fraud” or business email compromise, it’s a highly targeted form of phishing. The fraudster poses as someone the victim trusts (an executive, a supplier, a client, a lawyer) to obtain a payment or financial information. According to the RCMP, it’s a criminal offence whether or not the money was transferred.
The four faces of the fraud
The fake executive
“I’m in a meeting, I need you to make an urgent transfer for an acquisition. Keep it quiet.”
The fake supplier
“We’ve changed banks: here are our new details for your next payments.” The most common variant in SMBs, often sent from the supplier’s real, hacked mailbox.
The fake payroll change
An “employee” asks to change their direct deposit. The next paycheque goes to the fraudster’s account.
Gift cards
The “boss” asks you to buy gift cards for clients and email the codes.
How the attack is prepared
The typical email, dissected
Hi Julie,
I’m in a meeting with our lawyers all day and can’t take calls.3 We’re finalizing an acquisition and I need to count on your discretion4: don’t tell anyone for now.
Can you send a $48,750 transfer before 3 p.m. today5 to the attached account? The banking details are new6, that’s normal.
Thanks, I’m counting on you.
Marc
Sent from my iPhone
- Look-alike domain: a hyphen and .co instead of .com.
- Pressure: “urgent” and “confidential” right in the subject line.
- Unreachable: you’re prevented from checking.
- Secrecy: you’re cut off from your colleagues.
- Tight deadline: no time to think.
- New banking details: the most reliable red flag in all of these frauds.
Fictional example.
The most common trap: the hacked supplier
In real life, the fraud often doesn’t come from a fake address, but from a real supplier whose mailbox has been hacked. The fraudster reads the exchanges for weeks, then replies within an existing conversation, with the real address, the real signature, the right invoice number and the right amount. Only one thing changes: the banking details.
What seems reassuring
The address is correct. The email passes every filter and the SPF, DKIM and DMARC checks, because it really comes from the supplier. The tone, the history and the invoice are genuine.
What should raise a flag
“We’ve changed banks,” “please pay this new account instead,” “our accountant is on vacation, here is a new void cheque,” or an invoice that arrives as a link instead of the usual attachment.
The golden rule: pick up the phone. Any change of banking details is confirmed by calling a number you already had on file, not the one in the email or its signature, which may have been altered. Ask for your usual contact. That two-minute call is the only check that works when the email address is the real one.
A few reflexes to build into your payment procedure:
- Keep a register of your suppliers’ banking details and phone numbers, updated only after verification by phone.
- Have a second person approve any change before the first payment to the new account.
- Be even more suspicious when the supplier insists, rushes you or says they can’t be reached.
- Warn the supplier if you have doubts: they may not know their mailbox has been hacked, and their other clients are being targeted too.
How to protect your business
Procedures first
- Mandatory call-back to a number you already know (never the one in the email) before any unusual transfer or change of banking details, even if the email comes from the real address of the supplier or executive.
- Dual approval of transfers above a threshold, by two people.
- Code word agreed on in person between management and accounting, also useful against cloned voices.
- Written rule: no executive will ever ask for a payment that bypasses the procedure. That way, the employee who checks isn’t afraid of displeasing anyone.
Technical protections
- Phishing-resistant MFA on every mailbox, so a real account can’t be hacked.
- SPF, DKIM and DMARC on your domain, so nobody can send email in your name.
- An “external email” banner and alerts on display names that imitate your executives.
- Monitoring of look-alike domains and of auto-forwarding rules created without your knowledge.
Trained people
The people who handle payments (accounting, assistants, payroll) are the main target. Short, regular training with real examples is worth more than a long annual course. To go further, see our 12 steps to protect your business in 2026.
Already sent the money? Every hour counts
- Call your financial institution immediately: give the amount and the receiving account, and ask them to recall the transfer and contact the bank that received it.
- Notify your IT support: a hacked account must be secured before the fraudster tries again.
- Report it to your local police (“CEO fraud”), the Canadian Anti-Fraud Centre and the Canadian Centre for Cyber Security (contact@cyber.gc.ca).
- Notify your insurer: some policies cover social engineering fraud, often with verification conditions.
Want to train your team or check your email protection?
Appelez le tech · 1 833 444-1041