CEO impersonation scam: recovering the transfer

The first hours after the transfer is discovered

Someone usually notices the payment does not match a real instruction only when the actual director asks about it directly. That moment starts the clock for any realistic recovery attempt.

Move quickly rather than spending time working out exactly how the message fooled your staff. Every hour that passes makes it more likely the funds have already left the receiving account.

Contact the bank first, then move to reporting, and leave the internal review for once the immediate actions are underway. This order gives the bank the best chance to act while the trail is still fresh.

Asking the bank about a recall

Contact your bank’s fraud team at once and describe the payment as an unauthorised transfer, not a routine dispute. Ask specifically about a recall or a hold on the receiving account.

A recall attempt works best within the same day, before the receiving bank releases the funds further. Give the transaction reference, the amount, the receiving account number, and the exact time of the transfer.

The bank needs these details immediately to act quickly, rather than asking you again later. Waiting to gather a fuller picture first usually costs more than it saves.

Reporting and reviewing who authorised the payment

Report the case to the police, including the Commercial Crime Investigation Department (CCID), with the message or call that triggered the transfer. Call the National Scam Response Centre on 997 if the transfer happened recently.

Alongside the report, review internally who approved the payment and why the usual checks were skipped. This is about understanding what happened, not assigning blame to the person who was targeted.

A short internal timeline, who sent what and when, helps both the bank and the police move faster. It also shows where a second approval step could have stopped the payment, similar to what happens in a business email compromise case.

Once the receiving account is known

If the bank or police confirm who controls the receiving account, a civil claim against the scammer or account holder becomes worth weighing. This matters most for larger amounts, where the cost of pursuing a claim is easier to justify.

Whether it is worth pursuing further depends on the sum involved and what the account holder actually has. Whether legal action is worth it sets out the questions that shape that decision.

Read more about how CEO impersonation scams work if you want to understand the pattern behind the message your staff received.

What to do next

Put the immediate actions in order: a bank recall request, a police report, and an internal note of the payment chain. Each step supports the others rather than replacing them.

Keep every message, call log, and transfer record together in one place. A lawyer or the police may ask for the full sequence, not just the final instruction.

If the amount is significant or the receiving account is now known, a short conversation can help you see the next step more clearly. You can also read more under legal options after a scam for how these cases are usually approached.