'CEO' Urgent Wire Request? Fraud
The email from the CEO is marked urgent and confidential: wire funds to close a deal today, don't tell anyone. It isn't the CEO — it's a scammer who studied the company's hierarchy and writing style. CEO fraud has stolen fortunes from careful companies; the defense is a verification habit, not vigilance alone.
TL;DR / Quick Fix
An urgent email from the 'CEO' demanding a secret wire transfer is fraud — executives never request wires by email alone. Verify through a separate channel: call the person or walk to their office. Report the message to IT and never reply to the sender.
Follow these steps
- Verify outside the email. Call the executive's known number or walk to their office. The scammer controls the email thread — never your other channels — see payroll diversion for the sibling scam.
- Inspect the sender address. Display names impersonate freely; the raw address reveals lookalike domains. 'CEO' from a free email service is disqualifying.
- Resist secrecy demands. 'Keep this confidential' exists to stop you from verifying. Real executives don't forbid you from confirming a wire with finance colleagues.
- Follow the wire process. Companies with dual-approval wire policies are nearly immune — no single email can move money. If your company lacks one, propose it.
- Report to IT immediately. Forward the message with headers. Your report lets IT warn others and block the sender domain company-wide.
- Never reply to the sender. Replies confirm an active target and invite refined follow-ups. Report, don't engage.
What NOT to do
- Do not wire money on email authority alone. No legitimate executive runs secret wires past finance — the premise violates every control.
- Do not trust urgency as authenticity. 'Close of business today' is pressure engineering, not business reality.
- Do not skip verification because the writing style matches. Scammers study real executive emails from breaches — style is forgeable.
- Do not assume small companies are safe. Small businesses get targeted precisely because they lack dual-approval processes.
Frequently asked questions
How do scammers impersonate executives so well?
Public bios, earnings calls, and breached inboxes provide writing samples and org charts. Research is cheap; your wire is the prize.
What if the email comes from the real domain?
Then the account may be compromised — even more reason to verify by phone. Compromised-vendor fraud is the advanced version.
We almost fell for it — what now?
Report to IT, review wire controls, and consider it a free penetration test. Near-misses should still trigger process improvements.