The message really did come from the executive's internal address.

This happens when their mailbox has been compromised beforehand: the fraud is then preceded by an account takeover. That's one more reason for verification to go through a channel different from the message itself — a call to a known number.

How can a small organization without a dedicated finance department protect itself?

A written rule is enough and costs nothing: any transfer above a threshold, or to a new payee, requires verbal validation by a second person on an already-registered number. The rule protects the organization as much as the person executing the payment.

Fake wire transfer order (CEO fraud)

In plain terms

A message that appears to come from management asks for an urgent, confidential transfer, outside the usual procedures. The confidentiality requested is meant to stop a colleague from checking.

Definition

CEO fraud targets businesses and associations: a message presenting itself as coming from management or an executive asks for an urgent, confidential transfer that bypasses the usual procedures.

How it works

The attacker first researches the organization from public information: org chart, executive's name, accounting department, ongoing deals. The message then arrives at the right moment — the eve of a holiday, closing period — and combines three levers: the authority of the supposed sender, the confidentiality invoked (a sensitive deal, an acquisition in progress) that forbids talking about it, and a deadline that prevents verification. The sending address imitates the organization's, or replies are redirected to another mailbox. What makes the fraud effective isn't the accountant's gullibility, but the social difficulty of contradicting an instruction presented as coming from the CEO.

Warning signs

Transfer request presented as urgent and confidential
Explicit instruction not to mention it to colleagues or your usual supervisor
Usual validation procedure bypassed "exceptionally"
Sender address slightly different from the internal address, or a separate reply address
New banking details, often abroad
Message sent just before a holiday period or at the end of the day

How to verify

Call the requester back on the already-known internal number, never on a number given in the message. Apply the two-person validation procedure required for every transfer, without exception: a legitimate request is never held back by a verification, and a real executive will never hold applying it against you.

What to do

Don't execute the transfer. Report the message to the finance manager and IT department, and warn other people authorized to make payments: the same request is often sent to them in parallel.

If it already happened

Contact the bank immediately: a very recent transfer can sometimes be blocked or recalled, and every hour matters. File a police report, keep the messages and connection logs, and notify the partners concerned if their details may have been used.

Frequently asked questions

The message really did come from the executive's internal address.: This happens when their mailbox has been compromised beforehand: the fraud is then preceded by an account takeover. That's one more reason for verification to go through a channel different from the message itself — a call to a known number.
How can a small organization without a dedicated finance department protect itself?: A written rule is enough and costs nothing: any transfer above a threshold, or to a new payee, requires verbal validation by a second person on an already-registered number. The rule protects the organization as much as the person executing the payment.

Official sources

Cybermalveillance.gouv.fr — Assistance and reporting (French government cybersecurity assistance service)

This article is part of the Financial fraud family. Last updated: 2026-08-31.