Executive impersonation fraud pushes employees to approve urgent payments or reveal sensitive data by pretending a senior leader sent the request.
It is a focused form of payment pressure that leans on rank and haste, even when the mailbox itself was never truly taken over.
How it works
The message often stresses secrecy, a deadline, or a deal that cannot wait for the normal approval path, and the displayed name may match the leader while the reply address, the writing style, or the request to skip a phone call does not.
Staff who are helpful and new are frequent targets because refusing a supposed leader feels risky.
The practical defense is a rule that outranks the urgency: money movement and sensitive data releases follow a known procedure, and a leader who is real will accept that procedure.
Publishing that rule in advance protects the employee who has to say no.
Concrete examples
- A new finance clerk receives a message that looks like the chief executive and is told to wire funds before a board meeting.
- A request asks for employee tax identifiers immediately and says not to mention the task to the usual manager.
- A real executive is traveling, and an impersonator uses that absence to claim that phone confirmation is impossible.
Protective measures
- Publish a written rule that no leader may demand a secret payment outside the normal approval path, and brief every new hire on it.
- Verify unusual executive requests through a known number or an in person check, even when the message says not to.
- Give staff explicit permission to delay a transfer that skips procedure, and back them when the request turns out to be real but impatient.
- Watch for mail that uses a leader's name with a reply address outside your domain, and show that mismatch to readers.