How to Respond to CEO Fraud

Verify before you do anything else

Call the director directly, on a number your company already has on file, never one given in the message or email itself. A short question only the real person would answer comfortably, such as a detail from a recent internal conversation, usually settles the matter quickly.

Do this even if the instruction claims to be urgent or confidential, since a genuine request from a real director can survive a short verification call.

If the director cannot be reached immediately, treat the instruction as unconfirmed rather than assuming it is genuine because time is short. A short delay to confirm is far less costly than a payment that cannot be undone.

If the transfer has not yet been made

Pause the payment while verification is underway, regardless of how much pressure the message applies. A short delay to confirm a large or unusual transfer is a reasonable business practice, not an overreaction.

Put a second person’s approval on any transfer above a set amount as standard practice going forward, so no single employee carries the weight of this decision alone.

If the transfer has already left

Contact your bank’s fraud line immediately and ask about a recall or a hold on the receiving account, since how a bank recall works explains what is realistic in the first hours. Speed matters far more than having every detail confirmed first.

Report the matter to the police and lodge it with the Commercial Crime Investigation Department at the same time, and call the National Scam Response Centre on 997 if the transfer was recent.

Preserve the evidence

Keep the original message or email with its full headers, the account details used, and a timeline of who was involved and when. This falls under the pattern of business email compromise, and the evidence supports both the bank dispute and any later legal step.

Get a short written account from anyone involved in approving the transfer while the details are still fresh in their memory.

Brief staff so it does not happen again

Explain clearly to finance and any staff who can authorise payments that verifying an urgent instruction by phone is standard practice, not a challenge to authority. This removes the pressure that makes this scam work in the first place.

This sits within the wider response covered in the BEC incident response checklist, and tightening controls afterward closes the gap for good.

Revisit this briefing periodically, especially when new staff join or when a director changes how they usually communicate with the team. A control that is understood once and then forgotten stops protecting anyone.