How these schemes reach the payment desk
CEO fraud is a form of business email compromise in which someone impersonates a senior executive, or sometimes outside counsel, to push an employee into an urgent wire or a change in payment details. The message may come from a lookalike domain or from a real account that was taken over, and in the second case the attacker may have been reading internal email for some time before acting. Newer versions add a phone call or a voice message that sounds like the executive. The employee who sent the money usually followed what looked like an instruction from the top, and how the company treats that person matters both for morale and for what the investigation can learn.
The first hours
Call your bank's fraud or wire room immediately and ask for a recall of the transfer, then follow up in writing. File a complaint with the FBI's internet crime center, which works with banks to try to intercept funds while they are still moving. Preserve the messages and ask your IT provider or a forensic firm to secure logs before they roll over, while resetting access to any account that may be compromised, rather than deleting messages or wiping devices. Pull the insurance policies too. Crime policies, cyber policies, and social engineering endorsements treat these losses differently, many require prompt notice, and some have exclusions written around exactly this fact pattern.
Questions that come after
Once the immediate scramble is over, harder questions follow. Did the company's own bank follow the security procedure it agreed to, and does the receiving bank bear any responsibility for an account it opened? Commercial wires are governed by rules that differ from those for consumer payments, and the agreement with your bank often shapes the answer. There may also be notification duties if the attacker had access to personal information in the mailbox. After an executive impersonation loss, we map out which of these issues apply and who should be told what. We also look at how payment approvals can be tightened so the same approach does not work twice.
