CEO fraud is a form of impersonation where a threat actor will falsify their identity, acting as a CEO (or other executive) at an organization and attempt to communicate with other employees, such as members of the finance department. These attacks are mostly focused, but not exclusive to, financial gain and often involve urgent requests for the transfer of money.​

CEO fraud is a term often used interchangeably with BEC, however they have some distinct differences. BEC is a broader category involving several types of email-based fraud. It is likely to involve impersonation, but this is neither definite nor limited to executives. In many instances of BEC, an attacker may target low-level employees, clients, or partners in the supply chain. CEO fraud is a sub-category of BEC and involves explicit impersonation of high-level executives.  

In general, most cases of effective BEC and CEO fraud involve social engineering meant to elicit an emotional reaction in the victim and get them to impulsively send sensitive information, cause disruption, or transfer funds without considering the sender’s authenticity.

Social engineering

CEO fraud is a form of social engineering. Social engineering is a group of techniques used by cyber-criminals to manipulate people by appealing to emotions. This can be done by masking as legitimate parties, targeting vulnerable individuals, building trust with a victim, creating a sense of urgency in a message, and more. Social engineering can be used to enhance phishing, smishing, spoofing, or other cyber-attacks that target human error. Because humans are susceptible to trusting other humans, the goal of social engineering is to present the victim with a seemingly legitimate situation.  

Human error

‍Employees might not be equipped with the proper knowledge to spot a sophisticated cyber-attack. New employees particularly can fall victim to a socially engineered phishing scam like CEO fraud and accidentally leak sensitive information or account details.

Financial loss

‍If a CEO fraud attack is successful, the victim party could suffer severe financial loss and reputational damage. Similarly, an organization can face legal consequences for having data and valuable client information leaked to the attacking party. Finally, a breach in the system will often result in a halt of business operations, costing organizations significant financial loss.

Spoofing has two popular meanings in cyber security. It can refer to:

1. The process by which a message (email, SMS, social media) has been delivered from a falsified sender or location in order to build trust, solicit information or have a victim engage in harmful links or attachments.

2. The process by which an IT user may hide parts of their identity to protect their privacy or perform malicious attacks without being caught or to increase their success of initial compromise.

CEO fraud is related to spoofed emails as the attacking party attempts to hide their true identity. While a spam email might use any fake email address, in CEO fraud the attacker deliberately spoofs the address of a high-ranking member of an organization, making it a much more sophisticated attempt to solicit information.

Identify potential attack paths‍

Organizations can identify the most vulnerable attack paths which an attacker might use to infiltrate an organization. To prevent CEO fraud, ensuring that all employees conduct security awareness training that addresses CEO fraud will bolster an organization’s overall security posture.  

Zero trust

‍Having a zero-trust approach to your security (such as providing multi-factor authentication) will help in the case of account compromise and other potential threats to business accounts. A zero-trust model implies no digital activity should be trusted and that all access and digital activity need to be continuously validated through authentication measures and controls.  

Test attacks

‍Security teams can run simulated phishing attacks to judge their overall security posture and employee awareness. This will also help identify potential attack paths potential for human error in their organization.

In general, scamming constitutes an event where a transaction is made with a victim’s knowledge, but without their understanding of the consequences. In instances of scam, a victim may be tricked into soliciting information or transferring funds knowingly. In the case of fraud, purchases or other malicious activity is conducted without the victim’s knowledge.  

For example, an employee might be scammed by a successful CEO fraud attack if a cyber-criminal poses as the CEO of their company and the victim sends them funds or sensitive data. In this scenario, the victim had knowledge of the funds being sent, but was tricked by the falsified credentials of the attacker.

Common indicators of a CEO fraud attempt include suspicious links or attachments in emails, misspelled words or unusual grammar, requests for sensitive information, and urgency or threats to act quickly.

Darktrace has developed a fundamentally different approach to email security, one that doesn’t learn what’s dangerous from historical data but forms an in-depth understanding of each organization and its users.

Darktrace / EMAIL focuses on individuals - how each person uses their inbox and what constitutes “normal” for each user - in order to detect what’s not normal. Our AI technology builds profiles for every email user, including their relationships, tone and sentiment, content and link sharing patterns, and thousands of other signals.

Because Darktrace understands the human behind email communications rather than knowledge of past attacks, it can stop the most sophisticated and evolving email security risks like generative AI attacks, BEC, account takeover, supply chain attacks, data loss, and ransomware.  

To learn more about Darktrace / EMAIL read our Solution Brief.