CEO fraud does not mean fraud committed by a CEO. The name refers to the disguise: FinCEN's advisory of 16 July 2019 writes of criminals "impersonating organization executives (otherwise known as 'Chief Executive Officer [CEO] Fraud')".
Fraud by a real executive is management fraud, a form of employee fraud. Both appear among the types in what fraud is.
What is CEO fraud, and is it the same as business email compromise?
UK Finance defines CEO fraud as a criminal impersonating the chief executive or another senior official to get an urgent payment, from inside the company's email system or with spoofing software (UK Finance, Annual Fraud Report 2026).
FinCEN's 2019 advisory defines business email compromise as fraud aimed at the accounts of businesses, nonprofits and government bodies through compromised or impersonated email. CEO fraud and supplier invoice fraud are two of its typologies. Email is the weapon in both. In FinCEN's analysis about half of all BEC fraud targeting financial institutions came through emails impersonating the CEO or president, a large overlap.
The FBI's Internet Crime Complaint Center (IC3) received 24,768 BEC complaints reporting 3,046,598,558 dollars in losses in 2025 (IC3 2025 Internet Crime Report).
How does CEO fraud work, and how does an email turn into a payment?
- Research. The criminal maps who approves payments.
- The email. It comes from the executive's hacked mailbox or a lookalike address.
- The pressure. "Urgent", "Secret" or "Confidential" discourages a check.
- The payment. The employee orders a wire. Automated clearing house transfers, virtual currency and gift cards appear in FinCEN's cases too.
- The cash out. Once the money lands with a money mule or a front, it moves on.
These steps follow Scenario 2 of FinCEN's advisory of 6 September 2016, where a hacked executive mailbox instructs the payments employee.
How do deepfake calls change CEO fraud?
In late January 2024 Hong Kong police took a case in which a fake chief financial officer of the victim's UK head office sent a phishing email and then held a video conference that police believe was recorded in advance from public clips. The victim authorized transfers to five local bank accounts and lost about 200 million Hong Kong dollars (Hong Kong Government, 26 June 2024).
Businesses told IC3 of over 30 million dollars lost to BEC scams involving AI in 2025, from chat generated CEO emails to cloned voices.
What types of CEO fraud are there, and how do they influence people?
Table 1. Types of CEO fraud and the control that stops each one.
| Type | What the criminal sends | Source | Control that stops it |
|---|---|---|---|
| Executive payment request | An urgent order "from" the CEO to pay a new account | FinCEN 2019; FinCEN 2016, "Red Flags" | Call the executive back on a number already on file |
| Compromised executive mailbox | Orders sent from the executive's own hacked account | FinCEN 2016, Scenario 2 | A second approver for every new payee |
| Supplier bank detail change | Future invoices "should be sent to a new account number" | FinCEN 2016, Scenario 3 | Call the supplier on the number in the vendor file |
| Attorney or adviser request | Instructions based only on emails from executives or attorneys | FinCEN 2016, "Red Flags" | Confirm with the named attorney directly |
| Payroll diversion | Requests that move money out of payroll accounts | FinCEN 2019, government victims | Confirm any payroll bank change in person |
| Data request | A request for employee tax forms or other personal data | FinCEN 2019 | Employee data goes out only after a call back |
Influence over people comes from rank: FinCEN says criminals impersonate executives "to discourage employees receiving the fraudulent payment instructions from challenging or confirming the order".
UK Finance counted 197 CEO fraud cases and 5.6 million pounds lost in 2025, the highest average case value of its eight APP scam types, just over 28,000 pounds.
"The vendor bank change request is the attack; firms that lock vendor bank details behind a call back to a number already on file stop invoice fraud before it starts," says Ufuk Gürdaş, a compliance specialist.
How does vendor and invoice fraud work in B2B payments?
In FinCEN's Scenario 3, a criminal posing as a supplier tells Company C by email to send future invoice payments to a new account, and the next wires reach the criminal.
Only the bank details change, hence the name invoice redirection fraud. FinCEN's 2019 advisory ties fake vendor invoices to larger BEC amounts than even CEO fraud. UK Finance says the scam often involves intercepted or compromised email; from the supplier's own mailbox, it is carried out through vendor email compromise (VEC). Its 2025 count was 41.3 million pounds lost to invoice and mandate scams in 2,305 cases, with 68 percent of the losses on business accounts.
External schemes come from someone posing as the supplier. Internal vendor fraud is the threat from within: an employee changes a vendor record to pay themselves.
The connection to money laundering sits at the receiving end. Sanctions and PEP screening and KYB checks on a new vendor and its beneficial owners (UBO) are the AML checks on a payee, and a bank that spots the scheme files a SAR.
What is the scammer's main goal in vendor invoice fraud?
The scammer's main goal is to redirect funds to fraudulent accounts, not to delay company audits, create fake products or cancel real invoices. The real invoice is paid, to the wrong bank.
Which red flags show up in accounts payable?
Red flags from FinCEN's 2016 advisory map straight onto accounts payable (AP) workflows:
- New bank details for a known supplier (Scenario 3).
- A lookalike sender address.
- "Urgent", "Secret" or "Confidential" in the request.
- Little time to confirm.
- A first payment to a new beneficiary, at or above the usual size.
- A second request right after a first payment.
No single red flag necessarily indicates suspicious activity, FinCEN adds. An invoice processing system can identify fraud by matching each invoice to the data available: its purchase order (PO), the vendor file and the bank change documentation. Before paying a new foreign account, check a beneficiary bank's SWIFT code.
Which laws apply to CEO fraud in the US, the UK and the EU?
Table 2. CEO fraud rules by jurisdiction.
| Jurisdiction | Rule | What it says | What it means for CEO fraud |
|---|---|---|---|
| United States | 18 U.S.C. 1343, wire fraud | A fine, up to 20 years in prison, or both; a fine of up to $1,000,000, up to 30 years, or both if it "affects a financial institution" | A federal charge for a scheme run by email and wire |
| United States | FinCEN advisories, 2016 and 2019 | Put "BEC FRAUD" in the SAR narrative when businesses or organizations are the scheme victims | The key term a US bank uses when it reports a CEO fraud payment |
| United Kingdom | Fraud Act 2006, sections 1 and 2 | Fraud by false representation; on indictment up to 10 years, a fine, or both, and on summary conviction up to the magistrates' court limit, a fine, or both | Extends to England, Wales and Northern Ireland only (section 15), not to Scotland |
| United Kingdom | PSR reimbursement rules for APP scams | Mandatory reimbursement; "The protections apply to individuals, microenterprises and charities" | A larger company that pays a fake CEO is outside them |
| European Union | Regulation (EU) 2024/886, Article 5c of Regulation 260/2012 | Verification of the payee before the payer authorizes a credit transfer | Providers in euro area Member States by 9 October 2025, in the other Member States by 9 July 2027 |
None of these rules names CEO fraud, and the statutes treat it as fraud. Payment rules then decide who carries an APP loss or check the payee first.
How is CEO fraud different from phishing, whaling and invoice fraud?
Table 3. CEO fraud and its neighbor terms.
| Term | Who is impersonated | Who is targeted | What the criminal wants |
|---|---|---|---|
| CEO fraud | The CEO or a senior executive | Staff who can pay | An urgent transfer or data |
| Business email compromise | Anyone in the payment chain | Businesses, nonprofits, government bodies | Misdirected payments or data |
| Invoice or vendor fraud | A real supplier | Accounts payable | Invoices paid to a new account |
| Phishing | Any trusted sender | Anyone | Logins, data, malware |
| Whaling | Varies | A "big phish", such as a board member | Access to valuable assets |
| Impersonation fraud | Any trusted person or body | People and firms | Money or details |
CEO fraud uses the executive's name to reach staff, while whaling, in the NCSC's guidance on phishing, is spear phishing aimed at the executive. Spear phishing, a message written for one named person, can deliver either, and FinCEN's 2019 advisory counts training to spot it among the defenses against BEC. CEO fraud is executive impersonation, the executive case of impersonation fraud.
How do finance teams stop CEO fraud?
The key prevention controls sit at the payment itself:
- Callback. Require "a second type of communication" (NCSC) for every request and bank change, such as a call to a number already on file.
- Separation of duties. One person sets up a payee, another approves the payment.
- Name check. In the euro area, read the payee verification result.
- Vendor file reviews. Each recent bank change should match its documentation.
On the bank side, complead, formerly Sanction Scanner, can help: its bank transaction fraud monitoring scores each transfer before it is executed, checks the receiving account for mule links and known fraud signals, and lets the fraud team hold, block or release the payment. The guide to how fraud detection works goes deeper.
What should a firm do after paying a fake CEO?
IC3's guidance is to ask the bank for a recall of the funds immediately and to file a complaint at ic3.gov. In April 2025 a city government office in Oregon reported a BEC loss of over 6 million dollars; the receiving account was already frozen after a March 2025 Financial Fraud Kill Chain request, so the originating bank recalled the wire. In 2025 the kill chain froze 679,013,183 dollars across 3,900 incidents, 58 percent of the attempted theft.
That leaves one decision for a finance lead: who in your organization may change a payee's bank details, and on what evidence.
Related terms
- Impersonation fraud. Posing as someone trusted for money or data.
- Phishing. A deceptive message that steals data.
- Wire fraud. Fraud by wire communications.
- APP fraud. The victim authorizes the payment.
- Account takeover fraud. A criminal controls a real account.
- Money mule. Someone whose account moves criminal proceeds.
