CEO fraud makes up 11% of all external fraud against businesses

Figure 1: percentages of businesses hit by different types of external fraud (source: Allianz Trade)

CEO fraud

CEO fraud is a form of cybercrime that requires significant preparation. Crooks pretend to be one of an organisation's executives – the CEO, the CFO or another senior manager – and use the authority that goes with their assumed role to urge a lower-ranking staff member to make a prompt, confidential payment. For that to work, the scammers need to find out about the organisation's executives (e.g. using social media), and will often spoof e-mail addresses or phone numbers. The associated time input is justified by the potential rewards: roughly half of the claims received by insurer Allianz are for sums exceeding €50,000.

Flawed procedures

CEO fraud exploits flaws in the design of payment procedures. High-profile cases from recent years have typically involved organisations where staff were accustomed to making very large payments on the basis of instructions given orally, even by phone. And to sending money abroad. The infamous Pathé case was typical in that regard.

Removing procedural vulnerabilities

It follows that a business is much less likely to fall victim if it has secure administrative procedures, such as linking payments to purchase order numbers are requiring two people to authorise them. Then, if everyone is instructed to stick rigidly to the procedures at all times, it's almost impossible for scammers to obtain money by tricking a single staff member.

E-mail security standards

Advice on preventing CEO fraud often fails to highlight the value of technical standards. In its warning, the VNG advises municipal council staff to look closely at the 'From' address on any mail about making a payment. Does it really come from inside the council? Of course, that's good advice. However, if the organisation doesn't use secure, modern e-mail standards, crooks will be able to spoof internal addresses, or trick recipients using typosquat domain names. The Forum for Standardisation recently reported that 4 out of 10 government bodies don't support the standards. At the present rate of adoption, it'll be 2030 before the public sector is meeting its information security obligations. On Internet.nl, you can see whether an organisation's website and e-mail support secure, modern internet standards.

Monitor your name online

Many cases of fraud start with the registration of a domain name very like the name of a legitimate organisation, or the unauthorised use of a legitimate logo on a website. The practice known as 'typosquatting' involves registering a domain name so as to create web or mail addresses that look like those used by a legitimate organisation. Those addresses are then used for targeted scams involving (personal) data theft or fraudulent payments. Various services, including our own SIDN BrandGuard, are available to help you minimise the risks associated with typosquatting.