CEO fraud: the urgent wire transfer request

"I'm in a meeting and can't talk. I need an urgent, confidential payment." The message looks like it comes from your boss. In fact it comes from a scammer. This is CEO fraud, also called business email compromise. It targets companies, charities and local offices, including small teams where everyone knows each other.

How the scam works

1. The scammer does some research: the boss's name, who works in finance, who pays the bills. Much of it is public.
2. They write to someone in accounting or admin, posing as the boss, a manager or a supplier.
3. They ask for an urgent, secret payment, sometimes for a "confidential deal" or "a favor".
4. They answer your questions quickly and keep up the pressure until the money is gone.

A common variant: a "supplier" announces new bank details for their next invoice. The money then goes to the scammers' account.

Signs to look for

• A request outside the usual process: payment to an unknown account, with no purchase order or invoice.
• Urgency and secrecy: "don't tell anyone", "it must be done today".
• A boss who can't be reached: "I'm in a meeting, just email me".
• The sender's address: the display name is right, but the address is different or from a free mailbox.
• Replies going elsewhere: the reply address isn't the sender's address.
• New bank details announced by email alone.
• Gift cards requested "for clients".

What to do

1. Don't pay, and don't answer in the same thread.
2. Call the person on a number you already had, or check face to face.
3. For any change of bank details, confirm by phone with a known contact at the supplier.
4. Require two people to approve unusual payments. It protects employees too.
5. Report it: in the US at reportfraud.ftc.gov, in the UK to Action Fraud (actionfraud.police.uk).

What if I already paid?

• Call your bank right away and ask for a recall of the payment.
• Tell your management, then report it to the police with the email as evidence.
• Change your mailbox password if in doubt: the scammer may have access to it.

This scam shares its trick with the fake PayPal invoice: urgency stops you from thinking. See also the definition of CEO fraud.

Check it with Fishi

Forward the suspicious email to check@fishi.email, ideally as an attachment so the technical details are kept. Fishi examines the sender, the content and any payment requests, then replies with a clear verdict and what to do. It's free and needs no account. No tool is perfect: for a payment, always confirm by phone.