CEO fraud is a form of criminal deception. The victims are usually big companies and other organisations, which are targeted using 'social engineering' techniques to manipulate people's behaviour and emotions. A crook will pose as the organisation's CEO or another senior executive to trick the organisation out of money. Typically, a worker who is authorised to set up payments will get an e-mail from 'the boss' telling them to pay money into another account, which really belongs to the fraudsters.
CEO fraud and BEC fraud
CEO fraud is a high-profile kind of BEC fraud: business e-mail compromise fraud. That term covers a wide range of scam techniques, including phone calls where an executive's voice is mimicked, as well as hacking company accounts to get payments or steal financial data. BEC fraud can be devastating for targeted organisations, causing financial losses and reputational damage, while undermining confidence amongst customers and business partners.
How does CEO fraud work?
CEO fraud usually starts with a fake e-mail, which appears to come from one of the organisation's senior managers. In it, the 'manager' will instruct someone lower down in the company to urgently arrange a large payment, typically to a foreign bank account. If the person getting the mail hesitates, there may be a follow-up phone call where the crooks say that they're from a law firm or the like. Convinced by the body of correspondence and calls, the victim often goes ahead and makes the payment in good faith.
Another approach involves cybercriminals sending fake messages from the organisation's own domain after getting access to an insider's e-mail account. Known as 'domain name spoofing', that tactic is possible when the organisation doesn't work with open e-mail security standards. Here's a good example of what can happen.
Spoofing like that is particularly dangerous, because the fraudsters get to observe how people within the organisation communicate, and to see who makes the payments and is therefore worth targeting.
How can you spot attempted CEO fraud?
Often, a scam e-mail asking for money to be transferred comes from an address that looks like one of the organisation's real addresses, but isn't quite the same.
The writer will nearly always ask the recipient to act urgently.
They'll also stress the need for confidentiality.
The mail is often sent to someone within the organisation who has the authority to make payments.
Examples of CEO fraud
The 2018 Pathé case is a well-known example of CEO fraud. Fraudsters posing as executives from the company's head office in France mailed the Dutch management with various instructions, including orders to transfer funds, supposedly to cover a foreign acquisition. The targeted individuals were not therefore junior staff members, but the Dutch subsidiary's directors. Ultimately, the crooks extorted 19 million euros from the company. A key feature of the Pathé incident was that the victims were told to treat the transaction as 'strictly confidential'. While that heist was the biggest CEO fraud in Dutch history, it certainly wasn't the last. In recent years, various government entities, including municipal authorities, have been targeted using similar tactics.
How can you prevent CEO fraud?
Implement open web security and mail security standards
Various security standards for websites and e-mail servers have been developed to prevent domain spoofing. You can find out whether your domain name supports the standards by visiting internet.nl. If you're interested in implementing the standards on your domain name and e-mail service, it's usually best to contact your internet service provider, mail service provider or system administrator.
Make multi-factor authentication mandatory
Multi-factor authentication (MFA) involves adding an extra security check to the login process. With MFA enabled, even a cybercriminal who has got hold of the login details for an account will find it difficult to access that account. So it's wise to make MFA mandatory on all business accounts.
Apply the 'four eyes principle'
Following the 'four eyes principle' is an effective way of cutting out many errors and stopping many scams. Basically, what it involves is applying a rule that, above a certain threshold value, all payments and invoices need to be signed off by at least two different people.
Be extra alert during holiday periods
Crooks know that most organisations are thinly staffed during holiday periods and at weekends. That makes those times ideal windows for pulling off scams. So it's important to be extra wary of unusual payment requests during periods when people are away.
Do a security audit
A proactive approach can prevent a lot of problems. Carrying out an internal security audit can give you a better picture of your organisation's electronic security status.
One popular approach is to send your own 'dummy' phishing mail to see how good your personnel are recognising fraudulent mail.
People who fall for the scam can then be given special training on electronic security and spotting phishing attempts.
SIDN BrandGuard
SIDN BrandGuard is a monitoring service featuring a personalised dashboard, which notifies you immediately whenever a domain name similar to your brand name is registered. Getting early warnings enables you to respond promptly to prevent CEO fraud, domain name fraud, invoice fraud, typosquatting and identity fraud. And thus avoid the high cost and reputational damage caused by such scams.