What is CEO fraud and how is it different from BEC?
BEC (business email compromise) is the umbrella term for scams that use corporate email to divert payments or steal information. CEO fraud is the best-known variant: someone impersonates an executive and asks a person with access to payments for an urgent, confidential transfer.
The practical difference lies in where the email comes from. In impersonation, the attacker writes from a lookalike domain or with a fake display name. In a real compromise, they write from the legitimate mailbox of an executive or supplier they have broken into, and reply within genuine threads. The second case is much harder to spot at a glance.
| Variant | Who appears to be asking | What they ask for | Typical red flag |
|---|---|---|---|
| CEO fraud | The CEO or the finance director | An urgent, confidential transfer | Pressure, secrecy, a move to WhatsApp |
| Supplier bank details change | A regular supplier | Paying invoices into a new account | An account change by email, sometimes in a real thread |
| Advisor or lawyer impersonation | An outside firm | Payment for a sensitive deal | Pressure and confidentiality |
| Payroll diversion | An employee | Changing the account their salary is paid into | A request made only by email |
| Data theft | An executive | Tax data or employee data | An unusual request to HR or accounting |
For a sense of scale: the FBI's Internet Crime Complaint Center (IC3), which mainly receives complaints from the United States, recorded 24,768 BEC complaints in 2025 with reported losses of $3.046 billion. It is the fraud category with the second-highest losses in its report, behind investment fraud.
How do you spot a CEO fraud attempt?
INCIBE, Spain's national cybersecurity institute, explains that attackers first study the org chart, the names and email addresses of executives and their vacation dates, and often spend several weeks inside the victim's mailbox waiting for the right moment. These signs should stop any payment:
- Urgency with a deadline: the payment has to go out before 2:00 p.m.
- A request for confidentiality: don't mention this to anyone.
- An attempt to move the conversation to WhatsApp or a new phone number.
- A sender domain with one letter changed, or a reply-to address that differs from the sender's.
- A supplier's bank account change communicated by email.
- The supposed requester can't be reached: traveling, in a meeting, no signal.
- A first payment to that bank or that country.
- Calls or voice messages in the executive's voice asking you to skip the usual procedure. INCIBE warns about fake voices and videos generated with AI.
What should you do if you've already made the transfer?
Every hour counts. In its 2025 report, the IC3 stresses that if you detect a fraudulent transfer, you should contact your financial institution immediately and ask it to request a recall of the funds. INCIBE gives the same order: bank, police report and its 017 helpline.
- Call your bank now, by phone, and ask them to block or reverse the transfer and to contact the receiving bank. Have the date, amount, destination account number (IBAN) and reference ready.
- Report it to the police with all the documentation. Your bank and your insurer may ask for the report. In Spain, file it with the Policía Nacional or the Guardia Civil.
- If your company is in Spain, call INCIBE's 017 helpline for free, confidential guidance.
- Keep the evidence: don't delete the emails. Export them with full headers, along with receipts and conversations.
- Warn the executive or supplier who was impersonated through a verified channel, using a phone number you already had.
- Check for a compromised mailbox, yours or the supplier's: forwarding rules, sign-ins and apps with permissions.
- Inform your insurer and your legal counsel.
Can you get the money back after CEO fraud?
Sometimes, and it depends mostly on speed. The funds are usually moved to other accounts or other countries quickly, and every hop makes them harder to freeze. As a reference point, in 2025 the IC3 Recovery Asset Team managed to freeze around 58% of the amount in the cases it handled through its rapid freeze procedure, which covers BEC and other fraud. It is a US system, but the lesson is the same: the sooner your bank acts, the better your chances.
How do you prevent CEO fraud and BEC?
- Verification through another channel: confirm any urgent payment or account change by calling a number you already had, never the one in the email.
- Dual approval for transfers above a set amount and for any change of bank details.
- A written procedure for adding or changing supplier bank accounts.
- Phishing-resistant MFA on executive, finance and treasury accounts.
- An external sender tag on email, and detection of domains that look like yours.
- SPF, DKIM and DMARC with a reject policy on your domain. They make servers that enforce DMARC reject email that spoofs your exact domain, although they don't stop lookalike domains.
- Targeted training for accounting, treasury and executive assistants.
- Less public information about executives' schedules and travel.
How Ciberia helps against BEC
Many BEC attacks start with a mailbox compromised days or weeks before the fraud. Ciberia MDR monitors the email and identity telemetry you already have 24/7, together with your endpoint, network and cloud telemetry. The AI proposes the response, an analyst validates actions with impact, and containment is orchestrated on your own tools. The SLA is 15 minutes from critical alert to initial containment.
Ciberia CTM monitors mentions of your brand and your executives, as well as your employees' leaked credentials, which attackers use to prepare these scams. It sends alerts with context and the recommended action.
