What it is
CEO fraud, or business email compromise, is a scam where an attacker poses as an executive or supplier to get an urgent transfer made or an IBAN changed. With AI the messages imitate the person’s style and can also come with fake voice or video.
How it works
- 1The attacker studies the org chart and who can authorise payments, often from public information.
- 2They use a compromised account or a domain almost identical to the real one.
- 3They write with urgency and confidentiality to whoever handles payments.
- 4The money is moved quickly to accounts that are hard to recover.
How to spot it
- An urgent, confidential request for a transfer or IBAN change
- A slightly different domain or address
- The “boss” is unreachable and asks not to be called
- A supplier’s bank details change communicated only by email
How to defend
- A fixed procedure: double approval and phone verification on a known number for every new IBAN or out-of-the-ordinary amount
- Multi-factor authentication on all mailboxes
- SPF, DKIM and DMARC on the company domain
- Dedicated training for admin staff
- A “I always verify” culture, even with bosses
If you think you have been hit
- Call the bank at once to try to recall the transfer: hours matter
- Isolate and secure the accounts involved
- Report to the police and inform your legal advisor
And there are many, many more
The attacks above are only some of the most common: there are hundreds, and new ones appear every week. If the one that concerns you is not among them, write to me: I will tell you whether it really affects you and how to defend.
Contact meOther attacks
Watch the Shorts on YouTubeMatteo Russo · Updated October 2026