CEO impersonation scam: what to do

What a CEO impersonation scam looks like

A message arrives through email, WhatsApp, or a phone call, appearing to be from your company’s director or CEO. It asks for an urgent transfer, to close a deal, pay a supplier, or handle a confidential matter.

The tone matches how a busy director might actually write: short, direct, and slightly impatient. It may apologise for the odd hour or the unusual request, which makes it feel more believable.

Behind it is someone who has studied your company’s structure, perhaps from a data breach, a compromised account, or public information about who reports to whom.

Why urgency and secrecy work together

The message usually asks you to act fast and to keep the matter between yourselves for now. Both instructions serve the same purpose: to stop you from checking with anyone who could expose the scam.

An employee who wants to be helpful and avoid seeming difficult can feel pressured to comply without question. The scam relies on that instinct more than on any technical trick.

A genuine urgent instruction from a real director can survive a short verification call. If a request cannot survive that call, it was never truly urgent.

Can the transfer be recovered

Recovery depends on how quickly you act once the transfer is discovered. Contact your bank within hours to ask about a recall or a hold on the receiving account.

Once the funds move through several accounts or are converted, tracing becomes far harder. A civil claim against the scammer may still be worth considering for larger amounts, but no outcome can be promised.

Report the case immediately even while you are still gathering the full details, since speed matters more than completeness at this stage.

The verification step that stops it

Call the director on a number you already have, never one given in the message itself. Ask a direct question only the real person would answer comfortably.

Set a simple internal rule that any transfer above a certain amount needs a second person’s approval by phone, regardless of who is asking or how urgent it seems. This single step blocks most of these attempts.

What to do first

Report the payment through the first actions after a scam, and call the National Scam Response Centre on 997 if the transfer was recent. Read how a bank recall works so you know what your bank can attempt.

Make a police report with the message, the account details, and the transfer record, so the Commercial Crime Investigation Department (CCID) can open a case.