CEO fraud is prevented by removing urgency and secrecy as valid reasons to skip a payment check. Every documented case in this library relied on someone believing that questioning the request was riskier than paying it.
The impersonation is the visible part, but the exploited weakness is cultural. A finance clerk who is confident they can call the CFO and ask is a control. One who is not is the vulnerability.
Documented cases
- FACC lost roughly EUR 42 million in 2016, and dismissed both its chief executive and its finance chief afterwards.
- Crelan Bank in Belgium was hit by the same approach the same year.
- Leoni AG completes a striking 2016 cluster of European CEO-fraud losses.
The control that breaks it
- Write it down: no executive will ever request a transfer by email or message alone. Then have executives say so themselves.
- Make “I need to verify this” a protected action, never a career risk.
- Treat confidentiality demands as a red flag. Legitimate transactions survive a second pair of eyes.
- Apply dual authorisation with no seniority override.
Related: CEO fraud vs BEC · whaling vs CEO fraud · CEO fraud
Related
Social Engineering Examples