CEO Fraud

CEO fraud is a cybersecurity risk where cybercriminals spoof company email accounts and impersonate senior executives. It is also known as whaling or Business Email Compromise (BEC). 

CEO fraud attacks are targeting at least 400 firms per day, with almost $1 billion in losses per year. 

Cybercriminals impersonate senior executives of the target corporations to convince employees to transfer large amounts or send confidential information.

What is CEO Fraud?

CEO fraud is a type of phishing attack where criminals pretend to be high-ranking individuals within the company, typically the chief executives (CEOs). However, it extends to other senior positions, including directors, and the head of HR or accounts. 

Scammers often send emails that appear to come from legitimate company executives. These emails create a false sense of urgency and authority, pressuring employees to take immediate action without verification.

Who are the Victims of CEO Fraud?

The victims of CEO fraud range from large corporations to small businesses. Primarily, cybercriminals target businesses that work with foreign suppliers and regularly make wire transfer payments. Cyber criminals use social engineering to convince an employee to transfer money or divulge confidential information, such as company passwords, to use for stealing data and installing malware on the company network.

Companies that lack strict verification protocols, such as Know Your Business (KYB), are often victims of CEO fraud. Internal operational inconsistencies in security systems make firms fall prey to heavy financial loss resulting from whaling and BEC. 

“Tailored scams are becoming increasingly effective against enterprises who fail to have robust policies in place to verify wire transfer requests,” Paul Burbage, a security researcher for Leesburg, Va.-based firm PhishMe, told FedScoop.

Example of CEO Fraud 

CEO fraud is a growing cybercrime tactic that is affecting businesses worldwide. According to the FBI (Federal Bureau of Investigation), companies based in the US and the UK, and  177 other developing and emerging countries have often been victims of CEO fraud. This rising threat underscores the consideration and implementation of effective fraud preventive measures.

There are various emerging cases where businesses undergo whaling attacks and lose heavy amounts. It is not a new cybercrime practice, but it has been targeting companies for decades. In September 2016, a famous German company, Leoni AG, was the victim of CEO fraud; it lost $40 million in a minute by falling prey to an email phishing technique.  A digital news and community platform has reported this case. According to this news: 

“Investigators disclosed that Leoni AG’s CFO originally received a cloned email that appeared written by an executive with a request carefully designed to comply with existing company-specific policy. Local press reports suggested the attackers were familiar with the organization’s wire transfer protocol.”

How to Recognize CEO Fraud?

CEO fraud is more complex to spot. However, there are still some clues that help point to cyberattacks. Here are some common things that fake email messages have in common: 

• A request to transfer funds or share sensitive information 
• An urgent tone 
• The impersonated sender often remains unavailable. 
• Scammers imply that the sender is unavailable due to being in a meeting or due to a technical problem. It gives them an edge to mitigate the risk of being identified.
• A Request for confidentiality.
• Most of the time, CEO scam attacks come near the end of the day, with a request needing to be completed before EOD.
• Fraudsters ask to keep the email confidential and mention not to disclose it to any colleagues.  
• Though the email appears legitimate, criminals control both the recipient company and the account information. This highlights the need for business verification.
• These phony emails resemble the CEO’s writing style and frequently address the recipient by name to create the impression that the message content is important.