CEO fraud: how can you spot a fake boss asking for an urgent transfer in 30 seconds?

The scenario in brief

Example, made up for illustration. One Friday at 4.40 pm, the office manager of a medical practice receives an email from the senior doctor. He is at a conference, cannot phone and asks for a €38,000 transfer ‘before Monday’ to reserve an imaging machine. The last line reads: ‘Keep this quiet, I don’t want to worry the team.’

The email carries his name, his signature, his turns of phrase. Only the address is different, by one letter. Ten minutes later, a ‘legal adviser’ calls to confirm and push things along. The receiving account is abroad.

This is CEO fraud, also known as boss fraud or the fake boss scam. The good news: it almost always follows the same script. Once you know what to look for, you can spot it in under a minute.

How the scam is set up

Febelfin, the federation of Belgian banks, describes a scam prepared in several stages. Nothing is improvised:

1. Scouting. The fraudsters find out who can pay and how payments are approved. They call or write, posing as an auditor or a public body.
2. Impersonation. They write to the person who makes payments, posing as the boss: either from the boss’s real mailbox, which has been hacked, or from an almost identical address, often just one letter off.
3. The set-up. A large sum has to go out urgently and in the strictest confidence. Sometimes a fake lawyer or a fake consultancy ‘confirms’ the request.
4. The vanishing act. The money lands in the account of a ‘mule’, a person who lends out their account, then moves on very quickly to the fraudsters’ accounts.

The pretext is carefully crafted. KBC bank mentions a company takeover or a tax audit, with a large transfer to be made in secret and in a hurry, in most cases to a foreign account. If the employee hesitates, the fraudster plays on authority or flattery and drops important names to add pressure.

The most detailed figures on the scale of the problem come from the United States. In 2024, the FBI received 21,442 complaints about this kind of email fraud, with around $2.77 billion in reported losses (IC3 report 2024). It is the second most costly category, behind investment scams.

The 5 warning signs to spot in 30 seconds

Before you touch the banking app, check the request against this list. It draws on the warning signs described by Febelfin and KBC.

A single sign on its own does not mean much: real emergencies do happen. But as soon as two signs appear together, the rule is simple: stop and check, no exceptions, whatever name is at the bottom of the message.

The almost identical address

Look at the part after the @ sign, the domain name: that is the company’s address on the internet. An ‘rn’ in place of an ‘m’, an extra hyphen, a ‘.com’ instead of your usual ending: it is often the only visible clue. Febelfin advises always checking that domain name.

But if the boss’s real mailbox has been hacked, the address will be perfect. That is why calling back matters more than a sharp eye.

The golden rule: don’t reply, call back

All the official sources point to the same step: check through a different channel from the one the message came in on. Febelfin recommends calling the person back on a number you know. KBC adds: don’t trust a request made by email or phone, and call a known landline number yourself.

• The right number: the one in your address book or the internal directory. Never the one written in the email or in the signature.
• The right moment: before the payment. Once a transfer has gone, it is hard to get back.
• The right question: ‘Did you ask me for a €38,000 transfer to this account?’ Not ‘Is that really you?’, to which an impostor will always say yes.
• If nobody answers: wait. No serious boss will blame anyone for checking before paying.

The boss’s voice or video is no longer enough

Febelfin says so in black and white: fraudsters increasingly use artificial intelligence to imitate a voice or a face, in a phone call, a voice message or a video call. Its advice: even if the request seems genuine, always check it through a channel you know.

The FBI also lists phone numbers and video meeting apps among the channels misused for this type of fraud, not just email (IC3 report definitions).

Remember this: an incoming call proves nothing, even if the right number appears on screen. Febelfin points out that fraudsters can ‘spoof’ a number. You make the call, on the number you already have.

Checking the beneficiary’s name: useful, not enough

A European regulation (2024/886) now requires banks in the euro area to compare the name you type with the real holder of the account (the IBAN) before a euro transfer. Febelfin sets out the possible answers:

• The name matches: the transfer can go ahead.
• It almost matches: the bank shows the registered name, so you can correct a typo.
• It does not match: you get a warning.
• The check is not possible: the beneficiary’s bank did not respond, for example because of a technical problem.

It genuinely helps against fake account numbers. But Febelfin is clear: you remain responsible for the transfers you make. And if the fake boss gives you the exact name of the account holder, the mule’s name, the check will say everything matches. A warning should stop you. The absence of a warning proves nothing. Note: the check only covers euro transfers to a bank in the euro area. For an account outside the euro area, or a transfer in another currency, the bank checks nothing.

What to put in place this week

These measures come from Febelfin’s recommendations. None of them needs a budget, only a decision.

KBC bank also advises not answering questions from strangers about who makes the payments: this is often how the scouting starts.

In a healthcare practice

The senior practitioner is often with a patient, in theatre or on call: the excuse ‘I can’t talk right now’ sounds perfectly normal. And the person who handles payments is sometimes alone at reception, with no colleague to ask.

Agree a rule in advance, in writing: no unusual transfer without spoken confirmation from the senior practitioner, on their usual number, even if that means waiting until the end of surgery. The practitioner, for their part, commits to never getting round this rule themselves.

If the transfer has already gone

Every hour counts. Febelfin points out: the sooner you alert your bank, the better your chances of getting the money back.

1. Call your bank immediately, on its dedicated fraud number, available 24 hours a day. It will contact the beneficiary’s bank to try to block the transfer or the account.
2. File a complaint with the police, as Febelfin recommends.
3. Alert your IT provider if the boss’s mailbox may have been hacked: passwords must be changed, as the fraudsters have probably had access to a lot of information.
4. Keep every trace: the emails (don’t delete them), the phone numbers, the transfer orders.

Finally, don’t look for someone to blame in the team. A person who was caught out and says so straight away saves the hours that count. Someone afraid of being punished keeps quiet, and the money has time to vanish.

Secure your bank transfers→