CEO Fraud attack

The typical attack is an email that looks as if it comes from a member of management and asks for a large transfer to a foreign account, with a plausible reason. Forged letters with fake logos, stamps and signatures occur too. The criminals research the company first, in the commercial register and through calls to employees, and they put the employee under time pressure and ask for silence.

The instruction no longer has to be in writing. In 2019 the CEO of a UK energy company transferred 220,000 euros to a Hungarian account after a phone call in which the caller used an audio deepfake of the voice of the parent company's chief executive. AI tools that detect such fraud are the subject of the AI fraud detection page.

Business email compromise is the wider category: attacks by email that pose as a senior colleague, a trusted customer or a supplier. The supplier variant is the invoice with changed bank details.

The Austrian aerospace supplier FACC lost 42 million euros in an attack in February 2016, and its CFO and CEO were dismissed afterward. FBI estimates put losses at more than 50 billion dollars from business email compromise between 2013 and 2022. In Germany the automotive supplier Leoni lost 40 million euros in 2016, and many companies do not report a case at all, for fear of damage to their image.

An approval rule that the person giving the instruction cannot bypass is the first defense: every payment above a limit needs two people, and neither can be the one who asked for it. In Germany the distributed electronic signature of EBICS enforces this at the bank, because a payment file waits until the second authorized signer has signed. Treasurers at a 2015 roundtable reported by Treasury Management International named fraud prevention as the main reason for centralizing payments in a payment factory, and one group made no payment on a telephone instruction.

New or changed bank details need a call-back to a number from the existing records, never from the message. Verification of payee warns when the name does not match the IBAN, but a criminal who has opened an account in a matching name passes the check, as the fraud prevention page explains.

Finance Loop is the meeting place for the treasury, compliance and fraud teams of banks and companies who stop fraudulent payments. Finance Loop connects the finance, IT and AI communities in Germany, Austria and Switzerland, with events in Frankfurt, Munich, Berlin and Hamburg.

Finance Loop supports When Banks Say 'No', a half-day payments seminar in Frankfurt for compliance, treasury, finance, export and legal teams on blocked payments, de-risking and sanctions. Finance Loop is also media partner of Capital & Code, a Frankfurt conference whose audience includes corporate treasurers who manage liquidity and risk.

CEO fraud is a scam in which criminals pose as a senior manager of a company and instruct an employee to transfer money urgently and confidentially to an account they control.

CEO fraud is one form of business email compromise. The wider term also covers emails that pose as suppliers or customers, for example an invoice with a changed IBAN.

Companies can use approvals by two people who did not give the instruction, call-backs to known numbers for any unusual request or new bank details, and a rule that no payment is released on a phone or email instruction alone.

Only partly, because Verification of Payee flags a name that does not match the IBAN, but a payment to an account opened in the name the criminal gave passes the check.