A Spoofed Director Email Asked for Money

What this scam looks like

An email, WhatsApp message, or text arrives that looks like it came from a director or senior manager. It asks for an urgent transfer to a new account, often framed as confidential or time sensitive.

The sender address or number is close to the real one but not quite. A reply-to address may differ from the display name, or the number may be newly registered.

The request usually pushes you to skip the normal approval chain. It may say the director is in a meeting or overseas and cannot be reached by phone.

Why it catches finance teams off guard

The message is timed for when verification is hardest: end of day, before a public holiday, or when the real director is genuinely travelling. It uses real names, real project details, and sometimes a tone copied from past emails.

Junior staff often feel unable to question a director’s instruction, especially under pressure to act fast. That hesitation is exactly what this scam is built to exploit.

What to do if the transfer already left

Contact your bank immediately and ask for the transfer to be recalled or held, since how a bank recall works explains the process and its limits. Speed matters most in the first few hours, so do not wait for internal sign off to make the call.

File a police report and lodge it with the Commercial Crime Investigation Department, and call the National Scam Response Centre on 997 for urgent cases. Keep the original email or message headers, the account number, and a timeline of who approved what and when.

This pattern falls under business email compromise, and understanding the wider pattern can help you spot related attempts on other accounts.

How to verify future payment instructions

Any change to a payment instruction, especially a new account or an urgent request, should be confirmed by phone using a number you already have on file, not one given in the message. A short callback can stop the transfer before it leaves.

Build in a second sign off for transfers above a set amount, even when the request appears to come from the top. This is a control, not a sign of distrust.

What to do next

Report the incident through the official channels first, since a documented report supports any later step. Keep every document: the message, the account details, the transfer confirmation, and your internal approval trail.

If the amount is significant or the receiving account can be traced, a first assessment of whether legal action is worth it can clarify realistic next steps before your company spends further.