CEO Fraud in 2026: How It Works, Examples & Prevention

Key takeaways

• CEO fraud is a form of business email compromise (BEC). Attackers impersonate an executive to trick employees into sending money, changing bank details, or sharing sensitive data.
• AI has removed the old warning signs. Poor grammar, robotic audio, and low-quality video have been replaced by flawless writing, cloned voices, and convincing deepfake video.
• The strongest defense is a verification process that doesn’t depend on spotting the fake. Confirm every payment or bank change through a second, known channel.
• Email security adds a layer that catches what processes and training miss. It can flag suspicious requests before an employee acts.

What is CEO fraud?

CEO fraud is when attackers impersonate a CEO or other senior executive to persuade an employee to send money, change bank details, or share sensitive data.

Your typical CEO fraud attempt goes like this: A finance employee gets an urgent payment request from the CEO, then a follow-up call. There’s no link or malware, just a convincing ask. That’s why it slips past filters and fools capable people.

The scale is large. The FBI's 2025 Internet Crime Report recorded 24,768 BEC complaints and roughly US$3.05 billion in losses, with businesses reporting over US$30 million in BEC losses to attacks involving AI.

CEO fraud vs whaling vs BEC

You may have heard the terms CEO fraud, business email compromise (BEC), and whaling thrown around, but what’s the difference?

1. Business email compromise (BEC): The umbrella term covers impersonation of executives, suppliers, and lawyers, and targets any employee with payment access. Typical goal: Stealing money, redirecting payments, or exposing sensitive corporate data.
2. CEO fraud: Impersonation of a senior executive. Targets finance, HR, and assistants. Typical goal: A wire transfer, gift card purchases, or payroll data.
3. Whaling: A form of spear phishing where the attacker can pose as anyone, but the target is a senior executive. Typical goal: Credentials or large transfers.
4. Vendor email compromise: Impersonates a known supplier and targets accounts payable. Typical goal: Changing bank details on a real invoice.

How a CEO fraud attack works

Most attacks follow the same five steps, whatever the channel.

1. Research: Attackers map the org chart to find payment approvers, then gather data on those involved in executive travel, pinpointing suppliers from LinkedIn, press releases, and leaked data. The more of your data you reveal online, the better the lure they can create. That’s why it’s such a good idea to shrink your digital footprint.
2. Setup: Attackers register a look-alike domain, spoof a display name, or take over a real executive or supplier mailbox.
3. The ask: They send an urgent, confidential request, often timed for when the executive is traveling or the pay period is closing.
4. Pressure: If the target hesitates, the attacker follows up by phone, cloned voice, WhatsApp, or video call, adding pressure.
5. Cash-out: Once a payment is made, funds move fast through mule accounts, often across borders, which makes recovery challenging.

Five ways CEO fraud is changing in 2026

Like classic phishing lures, CEO fraud attempts used to be identifiable thanks to spelling errors, clunky messaging, or missing context that gives the game away. Today, these classic warning signs are no longer so relevant. Here’s why:

1. AI writes the perfect executive email

Spelling mistakes and odd phrasing are gone. AI copies an executive's tone from interviews, posts, and leaked emails, and attackers can send thousands of personalized variants, so pattern-based filters miss more often. This is spear phishing at industrial scale.

2. Deepfake voice and video close the deal

Deepfake CEO fraud typically uses email or messaging apps as an opener. An AI-generated voice call (vishing) that clones the CEO’s voice, or a deepfake video meeting, removes the target's doubts, using real-world details as an anchor to create legitimacy.

3. Attacks move across channels

Requests typically start by email or WhatsApp, then switch to SMS, Teams, or Zoom, where there are fewer controls and protections. Smishing (SMS phishing) and messaging apps are often the bridge to lure the target somewhere less safe.

4. Real accounts, not just look-alike domains

More attacks come from hijacked executive or supplier mailboxes, so SPF, DKIM, and DMARC checks pass. Attackers often add hidden inbox rules to read replies and hide warnings from the real owner. AI-powered email security, such as Slash, can help detect today’s more sophisticated attacks.

5. Fake lawyers and phony deals

Recent cases add a second character, often an outside lawyer or adviser, plus an NDA, to make secrecy feel normal. Voice cloning makes this second character cheap to add.

CEO fraud examples: four recent cases and one classic

These CEO fraud examples, dating from 2015–2025, show the complexity of more recent cases and how quickly CEO fraud has evolved.

Example #1: Multinational company (Singapore)

Date: March 2025

What happened: The finance director of an unnamed multinational company was messaged on WhatsApp by someone posing as the CFO. They spoke to a fake lawyer and joined a Zoom call with deepfaked executives, including the CEO. They then transferred nearly US$500,000. Luckily, Singapore and Hong Kong police traced and withheld the funds within days.

Outcome: Nearly US$500,000 fully recovered

Example #2: Ferrari (Italy)

Date: July 2024

What happened: A Ferrari executive received a WhatsApp message from someone impersonating CEO Benedetto Vigna – using an unfamiliar number – about a confidential and highly sensitive deal. When the fake Vigna then called to discuss the deal, the executive noticed a slight stiffness in his voice, which prompted him to ask something only the real Vigna would know: what was the book he had recommended to the executive recently? Unable to answer, the scammer hung up.

Outcome: Failed attempt

Example #3: WPP (United Kingdom)

Date: May 2024

What happened: The Guardian reported that WPP CEO Mark Read was impersonated using an elaborate deepfake attempt on a Microsoft Teams call. Criminals impersonated Read using a fake WhatsApp account, a voice clone, and YouTube footage, trying to persuade an agency executive to set up a new business and hand over money and personal details.

Outcome: Failed attempt

Example #4: Arup (Hong Kong)

Date: January 2024

What happened: A finance employee at Arup joined a video call in which he thought he was chatting to his CFO and other finance colleagues to discuss a sensitive deal – but everyone in the meeting was being impersonated by sophisticated video deepfakes.

Outcome: Approximately US$25 million lost

Example #5: Ubiquiti Networks (United States)

Date: June 2015

What happened: Scammers impersonated Ubiquiti Networks staff and sent fraudulent payment requests to the finance department, prompting the company’s Hong Kong subsidiary to wire about $46.7 million to overseas accounts held by third parties. Ubiquiti recovered about $15 million and was still trying to recover the remaining $31.7 million.

Outcome: US$46.7 million lost, approximately US$15 million recovered

As these five examples show, there’s no end to the creativity and inventiveness scammers demonstrate when targeting us with CEO fraud. And while we might occasionally get lucky – like the quick-witted Ferrari executive – we can’t rely on luck to stay safe.

Who gets targeted by CEO fraud?

Attackers target people within organizations who can act quickly, have access to the funds they need, and are unlikely to question requests from senior executives.

1. Finance and accounts payable

• Why attackers target them: They can move money easily.
• Typical request: An urgent wire transfer or changed supplier bank details.

2. HR and payroll

• Why attackers target them: They hold personal and salary data.
• Typical request: Employee tax forms or payroll redirection.

3. Executive assistants

• Why attackers target them: They act for executives and know their schedules.
• Typical request: Gift cards, calendar access, or forwarded emails.

4. IT

• Why attackers target them: They control access.
• Typical request: Password resets, new accounts, or MFA changes.

5. New joiners

• Why attackers target them: They don't yet know normal processes.
• Typical request: Any "quick favor" from a senior name.

2026 red-flag CEO fraud checklist

CEO fraud is always evolving – and so are the red flags that suggest you might be facing an attack. Here are the biggest things to look out for in 2026:

1. Urgency plus secrecy: "Keep this between us until the deal is announced."
2. A request to move to WhatsApp, a personal number, or a new video link.
3. The executive is “traveling” or “in meetings” and can't be reached normally.
4. New bank details, or a payment outside the usual process.
5. An outside lawyer or adviser you have never dealt with, or a surprise NDA.
6. On calls: reluctance to answer personal questions, or odd pauses.
7. A reply-to address that differs from the sender, or a domain that is one letter off.

How to prevent CEO fraud: process, people, and technology

As fakes become virtually impossible to spot, preventing CEO fraud comes down to the right combination of strong processes, trained people, and proactive technology.

Process: a payment verification protocol

• Confirm every payment, bank change, or data request through a second, known channel, never the one the request arrived on.
• Call back on a number already on file, not one supplied in the message.
• Agree on a challenge question or code word with executives.
• Require dual approval above a set amount, and a waiting period for new or changed supplier bank details.
• Write this up as a one-page policy that finance can follow.

People: training and culture

• Ask executives to lead a push for CEO fraud awareness, letting staff know that double-checking the details is crucial – even when it slows down business.
• Train the high-risk teams above on 2026 versions of the attack: flawless emails, cloned voices, deepfake calls, and impersonations working across different channels.
• Make reporting quick and blame-free, and thank people for false alarms.
• Run realistic simulations of executive and supplier impersonation, with a short lesson straight after. Our guide to phishing training for employees shows you how.

Technology: the baseline

• Enforce SPF, DKIM, and DMARC to stop spoofing of your own domain.
• Use phishing-resistant MFA (security keys or passkeys) to make account takeover harder.
• Set alerts for new inbox forwarding rules and unusual sign-ins.
• Reduce public exposure of executive schedules and finance team details. Start with your digital footprint.

Another key defense? Run phishing simulations that really get results. Check out our free checklist to find out how.

The role of email security in stopping CEO fraud

Email security solutions now play a greater role than ever in stopping CEO fraud – but not every tool is built the same way.

What traditional filters miss

• Gateways and SPF, DKIM, and DMARC stop known-bad senders and spoofed domains.
• CEO fraud often has no link, no attachment, and no malware, and may come from a real account, so it passes.

What to look for in 2026

• Analysis of what the email asks for and how: urgency, payment requests, unusual instructions.
• Warnings inside the email the moment you start reading.
• Selective alerts, so banners are not ignored.
• A quick way to check a suspected impersonation with the real person.
• One-click removal of a confirmed threat from every mailbox.
• Compatibility with your existing Microsoft 365 or Google Workspace filters.

How Slash can help

Slash adds a layer of semantic analysis plus technical signals, with Albert, Riot’s AI assistant, warning employees inside suspicious emails before they act. When impersonation is suspected, Albert checks with the employee through Slack, Teams, or Google Chat, and confirmed threats are removed company-wide in one action. You can read more about how Slash works.

What to do if you’ve been targeted by CEO fraud

Speed determines whether or not money comes back. If you suspect you’ve been hit, work through these steps in this order:

1. Call your bank immediately and ask it to recall or freeze the transfer.
2. Report it to the police and the national fraud service. In the US, that is the FBI's Internet Crime Complaint Center, whose Recovery Asset Team works with banks to freeze funds. In the UK, you can contact Report Fraud, and in France, cybermalveillance.gouv.fr.
3. Keep the evidence: emails with full headers, call logs, chat messages, and payment records.
4. Check for a compromised mailbox: inbox rules, active sessions, and recent sign-ins. Reset credentials and MFA.
5. Remove the email from every mailbox, and warn staff and affected suppliers.

CEO fraud is evolving: your defense needs to as well

AI and cheap deepfake tools have given CEO fraud a new lease on life. Process makes the fake irrelevant, training makes people pause, and email security catches what gets through.

Talk to one of our experts about how Slash can help bring everything together and keep your teams safe.

FAQ

1. Is CEO fraud the same as business email compromise? CEO fraud falls under the umbrella of BEC. BEC also covers impersonation of suppliers, lawyers, and other trusted parties.
2. What is the difference between CEO fraud and whaling? CEO fraud impersonates an executive to target other employees. Whaling targets the executive personally.
3. How much does CEO fraud cost businesses? BEC losses reported to the FBI were about US$3.05 billion in 2025. CEO fraud is one type of BEC, and the true figure is likely higher.
4. Can deepfakes really impersonate a CEO on a video call? Yes. In the 2025 Singapore case, a finance director joined a Zoom call with deepfaked executives, including the CEO. In the Arup case, every other participant was a deepfake.
5. Who is most at risk of CEO fraud? Finance and accounts payable teams, HR and payroll, executive assistants, IT, and new joiners.
6. Do small businesses get targeted? Unfortunately, yes. AI tools have made it cheaper and faster for scammers to target small to medium-sized businesses with CEO fraud.
7. Can money lost to CEO fraud be recovered? Sometimes, if you act fast. In Singapore, police withheld the funds within days. Call your bank straight away.
8. Does DMARC stop CEO fraud? Not on its own. It stops spoofing of your domain, but not look-alike domains, hijacked real mailboxes, or voice and video calls.