Executive Impersonation: When 'the CEO' Emails Asking for a Favor

The email arrives mid-afternoon, addressed to your office manager: “Are you at your desk? I need a favor handled quietly — I’m walking into a board meeting. — Sent from my iPhone.” It reads exactly like the boss: brief, busy, a little imperious. It isn’t the boss. Executive impersonation — “CEO fraud” — is one of the most reliable scams run against small businesses, not because it’s sophisticated, but because it aims a fake authority at a real virtue: your best people’s desire to be helpful when leadership asks. Here’s how it works and the defense that beats it.

Why this works on smart people

The scam is social engineering distilled to its three active ingredients. Authority: requests from the boss get processed differently — questioning them feels expensive, complying feels like the job. Urgency and unavailability: the boss is always in a meeting, boarding a plane, “can’t talk, just handle it” — which forecloses exactly the verification that would kill the scam. Secrecy: “keep this between us for now” (a surprise, a sensitive deal) isolates the target from the colleague who’d say “that’s weird.” None of this requires hacking anything; the attacker needs only your org chart and email addresses — which LinkedIn and your own website’s team page provide — plus a spoofed display name or a lookalike address that a phone’s mail app helpfully truncates to just “the name.” Timing is often researched too: executives’ travel and conference appearances are public, and the email lands precisely when the real person is genuinely unreachable.

The variants, in ascending order of damage

The gift card run. “Buying gift cards for client thank-yous — grab 5 × $200, scratch the backs, photo me the codes. Reimburse you Monday.” Small enough per-incident to seem beneath sophisticated crime, which is exactly why it’s high-volume: codes are instantly monetizable, untraceable, and the amounts often slip under expense radar.

The urgent wire. “Confidential acquisition / legal settlement — wire $48,500 to these instructions today; the attorney will follow up.” Aimed at whoever moves money, dressed in secrecy, and catastrophic — this is the pattern behind the biggest single-transaction losses small businesses suffer.

The payroll switch. “HR — please update my direct deposit before this cycle” sent to payroll as the executive (or as any employee). Discovered on payday, by the person whose check vanished.

The escalation version. If the executive’s actual mailbox has been compromised (a phished password, no MFA), all of the above arrives from the genuine address, in the genuine writing style, mid-genuine-thread. This is why impersonation defense and mailbox security are the same project.

The defense: two rules, said out loud by the people being impersonated

Technology helps — filtering that flags external mail using executives’ names, lookalike-domain detection, MFA everywhere — but the decisive control is procedural, and it only works if leadership installs it personally:

Rule 1: Requests involving money, gift cards, payroll, or credentials get verified by voice, at a number already known — every time, no matter who’s asking. Not a reply (you’d be replying to the attacker); a call or a walk down the hall.

Rule 2 is Rule 1’s enforcement clause, and it must come from the executives themselves: “I will never ask you to move money or buy gift cards by email alone — and if a message that looks like me pressures you to skip verification, that pressure is the proof it’s fake. You will never be in trouble for double-checking me. You’ll be thanked.” Said in a meeting, repeated at onboarding, reinforced in training. The scam’s entire mechanism is the fear of annoying the boss; the boss is the only person who can dismantle that fear, and thirty seconds of saying so is the cheapest security control in this entire library.

Round it out by making the targets aware they’re targets: office managers, EAs, bookkeepers, payroll, and new hires are the short list, and simply knowing the script — authority + urgency + secrecy = call to verify — inoculates most of them permanently. If one lands anyway: it’s a business email compromise incident — bank first if money moved, report at ic3.gov the same day, then check whether the impersonated mailbox is merely spoofed or actually breached.

The bottom line

Executive impersonation is a con, not a hack — it monetizes the gap between “the boss asked” and “did the boss ask?” Close the gap with one verification rule and one leadership announcement that makes following it safe, and the most reliable scam in small business becomes a story your office manager tells about the weird email she reported — which is exactly how it should end.