A fish, whale and CEO walk into a bar

Remember the good old days when fishing for info or money online was just called phishing? We’re an industry built on tech and science, but we do love our artsy synonyms and hyperbole. 

If you’ve ever had the pleasure of talking to Rois, our Head of Cyber Governance, you’ll know how she feels about the unreliability of research that looks at Business Email Compromise (BEC), whaling, Friday afternoon scams, and CEO fraud as different types of incidents. IT’S THE SAME THING.

We recently posted a blog about BEC, and we’ve also talked you through whaling and spear phishing, so to close the circle of education on all these types of email threats, here’s a quick guide to CEO fraud. 

CEO fraud: the facts

Well firstly, you should know that the FBI calls it Business Email Compromise (cue intense eye rolling). Secondly, it’s not about CEOs committing fraud. And finally, it’s not just about CEOs.

In an age when engagement and transparency are key to topping customer relations practices, most C-level executives will have a profile on a corporate website and social accounts combining marketing-approved streams of consciousness with the occasional personal opinion thrown in. It’s never been easier to build profiles of executives and impersonate their communication styles and that’s why CEO fraud is such an easy win for scammers.

Impersonating someone else in order to gain access to confidential information or money is the crux of the phishing attack, so CEO fraud simply extends that process to scammers masquerading as your boss with a c-level title and tricking you into committing a breach.

Common CEO fraud scenarios

  1. ‘CFO’ emails accounts to ask for a money transfer to be sent to a supplier – but the account details have changed and it needs to be action urgently.
  2. ‘CEO’ emails HR to ask for a list of employees and associated financial information to be shared with a new payroll company
  3. ‘Partner’ at law firm asks paralegal to send conveyancing monies to a new account due to an internal error

A 2019 report by the FBI found that organizations lost an estimated $1.77 billion due to these types of attack and it’s clear to see why. Faced with an end-of-day email from the CEO marked ‘URGENT’, you’d be forgiven for acting on it immediately. Invoice scams are particularly prolific as they play on an employee’s fear of the potential consequences of an unhappy supplier, or partner that could put pause to the organisation’s operations.

Identifying and eliminating CEO fraud

The reason so many phishing attacks come to fruition is that scammers are no longer satisfied with using lookalike email domains, using a lower case ‘L’ for the letter ‘I’ for example. Today, domain impersonation is a simple hack and it makes it impossible for a recipient to identify that the email purporting to come from their CEO is actually a fake.

Contrary to popular belief that email gateway protection, such as spam filters and appliances that weed out emails with malicious content, will protect organizations from domain impersonation, the only sure-fire way to eliminate the threat is with an entirely different (less resource intensive) approach. In the last few years, we’ve seen a wave of action against email impersonation, and global protocols such as DMARC have been widely adopted to tackle email fraud. 

How can Red Sift help?

The Red Sift data analysis platform is purpose-built for the challenges of cybersecurity. Products on the Red Sift platform include OnDMARC, OnINBOX, and OnDOMAIN, SaaS applications that work together to close the net on the phishing problem by blocking outbound phishing attacks, analyzing the security of inbound communications, and providing domain impersonation defense.

Red Sift find out more


Randal Pinto

17 Mar. 2020



Recent Posts


Red Sift Recognized on Deloitte’s EMEA Fast 500™ List

Francesca Rünger-Field

We’re thrilled to share that Red Sift has been included in Deloitte’s 2023 EMEA Fast 500 list. This recognition stems from 389% revenue growth over three years, $54 million in Series B funding, acquiring ASM innovator Hardenize, and introducing the Red Sift Pulse Platform. Read the press release here. About the award The Deloitte Technology Fast…

Read more
Brand Protection

The vital role of cybersecurity for Nonprofits: A deep dive 

Sean Costigan

Save the Children, a beacon of hope and change, has been dedicated to improving the lives of children for over a century. Founded in London, it now has a presence in 29 nations, employing 844 staff members in the UK alone and engaging over 3600 formal volunteers. As charities and nonprofits like Save the…

Read more

Red Sift brings DMARC data to the SOC with new Cisco XDR…

Rebecca Warren

Today, we’re thrilled to announce that we’re extending our partnership by joining the Cisco Security Technical Alliance and integrating Red Sift OnDMARC with Cisco XDR. This integration builds on the Domain Protection partnership we announced in November 2023 to bring visibility of business email compromise into the SOC (security operations center). At release, Red…

Read more

Preventing certificate related violations in cybersecurity frameworks:  A guide to certificate monitoring…

Rebecca Warren

TLS is one of the most widely adopted security protocols in the world allowing for unprecedented levels of commerce across the internet.  At the core of the TLS protocol is TLS certificates. Organizations must deploy TLS certificates and corresponding private keys to their systems to provide them with unique identities that can be reliably…

Read more