Executive impersonation: how to prevent it

What is executive impersonation?

Executive impersonation is fraud in which someone poses as a named leader, usually the CEO or CFO, to make a colleague, supplier or customer act. The ask is almost always one of three things: move money, share data or grant access.

Email is still the main channel, but it is no longer the only one. The FBI defines business email compromise as fraud carried out by compromising email accounts "and other forms of communication such as phone numbers and virtual meeting applications".^[1] A fake LinkedIn profile, a voice message or a video call can all carry the same request.

How big is the risk for a company?

Large, and well documented. In its 2025 annual report, the FBI's Internet Crime Complaint Center (IC3) recorded 24,768 business email compromise complaints with reported losses of $3,046,598,558.^[1] That made it the second-largest loss category after investment fraud.^[1] An earlier IC3 alert counted $50,871,249,501 in exposed losses from 277,918 incidents reported between October 2013 and December 2022.^[2]

These figures only cover what victims reported. Brand damage, legal costs and the time spent on recovery sit on top.

How do impersonation attacks work?

Most follow the same four steps:

1. Research. Public sources show who leads the company, who approves payments, which suppliers you use and when leaders travel.

2. A credible sender. The attacker uses a lookalike domain, a free email account with the executive's display name, a compromised mailbox or a fake social profile.

3. Pretext. A short, plausible message: a confidential deal, a supplier with new bank details, a gift card request before a meeting.

4. Pressure. Urgency and authority do the rest. The request arrives late in the day, during travel or at quarter end, and asks the recipient to skip the usual process.

AI makes the second and third steps cheaper. The FBI says chat generators can write official-sounding emails that mimic a CEO, and voice cloning can be used to request wire payments.^[1] Businesses reported losses of over $30 million to BEC scams involving AI in 2025.^[1] Separate FBI alerts warn that criminals use AI-generated audio to impersonate public figures and personal relations,^[3] and that AI-generated content "is often difficult to identify".^[4] Our guide to voice deepfakes and spear phishing covers the voice channel in depth.

How do fake executive profiles work?

A cloned profile copies a real leader's photo, title and bio on LinkedIn or X. It then sends connection requests to employees, partners and customers. People accept because the name is familiar, and the fake account gains a map of who works where.

From there it can send a message with a link to a fake file-sharing page, ask a new hire to buy gift cards, or approach a supplier about "updated" payment details. On public feeds, a fake account can also post false news about the company.

Watch for these signs:

• A second profile for a leader who already has one, often with few connections and a recent join date.
• Small differences in the name, title or profile URL.
• Requests to move a conversation to a personal messaging app.
• Any payment, credential or data request that arrives through social media at all.

Which controls stop payment fraud?

Process controls stop the money even when the message is convincing:

The FBI's own advice is to use secondary channels to verify requests to change account information,^[2] and to hang up and call a number you found yourself.^[3] Write these rules down and make clear that no executive can override them, including the real one.

On email, publish SPF and DKIM, then move DMARC to enforcement. Under the current DMARC standard, a "reject" policy tells receivers the domain owner considers failing mail "a clear indication that the use of the domain name is not valid".^[5] DMARC does not stop lookalike domains, so pair it with a typosquatting audit of your domain portfolio. Our guide to secure corporate DNS explains the records.

How should fakes be reported?

Through each platform's own impersonation route, as soon as a fake is found. On LinkedIn, members report a profile from its page and choose "This person is impersonating someone".^[6] Other networks have their own forms in their help centers.

Then tell people. Send staff a short internal note with the fake handle and a "do not engage" instruction, and warn key partners if the fake has contacted them. Keep screenshots, URLs and dates; they help the platform and any later legal action.

Who handles takedowns and incidents?

Specialist firms and counsel. When a platform will not act, when a lookalike domain is sending mail, or when money has moved, you need legal takedown notices, forensic work and incident response. Those are done by firms or counsel you contract with directly. Our domain takedown guide explains how that process runs.

If funds have left the account, call your bank at once and report to IC3 in the US or the national authority where you are.

Where should a team start?

1. Write a payment-change policy with callbacks and dual approval, and train finance and executive assistants on it.

2. Check SPF, DKIM and DMARC on every domain you own, including ones that never send mail.

3. List each leader's real social profiles and search for duplicates every quarter.

4. Agree a code word for urgent requests between leaders and finance.

5. Name the specialist firm or counsel you would call before you need them.

Our impersonation detection service covers the public checks behind these steps as part of our digital asset security work.