CEO fraud example: the urgent wire transfer request
Someone poses as the CEO or a director and asks a person in finance for a transfer outside the normal process: a confidential deal, a new payee and no time. It has no links or attachments: the whole scam is in the text.
Hi Carla, are you at the office? (Red flag 2)
We are closing an acquisition and I need you to send a wire today to a firm that is advising us (Red flag 3). It is confidential: please do not mention it to anyone until we announce it (Red flag 4).
I am in meetings all day and cannot take calls (Red flag 5). Reply here and I will send you the account details.
Martin
Sent from my phone (Red flag 6)
Six red flags that give the fake CEO request away
The address is not the company one
The name is the CEO’s; the address is a personal account. Many email apps show only the name, so you have to open the full sender.
A question to open the conversation
“Are you at the office?” does not ask for anything yet. It looks for a reply, so the request arrives once you have answered and it feels harder to back out.
A payment outside the process
A new payee, no purchase order and due today. The approval workflow exists precisely so nobody pays like this, not even at the CEO’s request.
Secrecy
Asking for confidentiality isolates the person: if they cannot ask anyone, nobody can stop the payment.
Impossible to verify
If they cannot take calls, you cannot confirm with their voice. That is the cue to call anyway, on their extension or through their assistant.
A signature that explains everything
“Sent from my phone” explains the short tone and the odd address. It is an excuse, not proof.
What to do if you get one
- Do not reply to the email: confirm the request on a channel you already know, such as the internal phone or company chat.
- Follow the usual payment workflow even if the request claims to come from the top. A real CEO understands that you verify.
- Report it to security and warn finance: the same attempt may have reached other people on the team.
- If the request includes bank details, do not enter them until you confirm them by phone with someone you know.
If you already replied or paid
- If you sent the money, call the bank on its official number and ask to stop or recall the transfer immediately.
- Tell security and the head of finance, and keep the full thread with its headers.
- If you replied but did not pay, end the exchange and report it anyway: whoever wrote now knows that address answers.
The same trap on other channels
On WhatsApp
A new number with the CEO’s photo writes “I changed my number, save this one”. The payment request comes next. The photo is copied from any public profile.
With a call or a voice note
To overcome doubt, they call or send a voice note that sounds like the executive. With AI tools, a voice can be cloned from public recordings such as interviews or videos.
From the real account
If someone broke into an executive’s mailbox, the sender is genuine. What remains is the out-of-process request, the secrecy and the urgency: that is why you verify the request, not only the address.
Questions about CEO fraud
Other scams to recognize
Would finance pay without verifying?
The CEO fraud email is simulated natively in Whalemate. The phone version, with or without a cloned voice, runs as a professional vishing service: our team writes the script, makes the calls and measures who hung up to verify before paying.