Specialisms
An instruction “from the very top”, confidential and urgent – and no one from management wrote it.
CEO fraud does not use technology, but hierarchy. A message in the name of management announces a confidential transaction, asks for discretion vis-à-vis colleagues and presses for an immediate payment. Those who execute it believe they are being loyal. The matter is frequently noticed only at the next regular contact – often days later.
Circumstances
Clarify the context
Evidence
Preserve documents
Deadlines
Explain any urgency
Approach
Discuss the next steps
Immediate steps
What is to be arranged immediately
The first hours decide the recovery, the first days the quality of the follow-up. Both should proceed in parallel and in an orderly way.
Have the payment recalled by telephone
Contact your bank by telephone without delay and expressly demand the recall of the transfer as well as the involvement of the recipient bank. Have the date and time of the report confirmed in writing. Recovery procedures are subject to deadlines that can be short and must be asked about at once.
Halt all open and scheduled orders
Stop further payments to the same connection and check whether further instructions have arrived in the same days. In many cases it does not remain with a single transfer; the second follows while the first is still being examined.
Verify the instruction through an independent channel
Call the person who allegedly issued the instruction on an internally stored number – not on the number from the message and not by replying to the email. Use a connection for this that does not run through the mailbox that may have been compromised.
Fully preserve the message and approval traces
Secure the message with full headers, any voice messages, the connection data of the call, the payment voucher with reference and the logs of the approval process. Delete nothing and do not hand over end devices for reinstallation before they have been secured.
Check systems for eavesdropping
Have logins, forwarding rules and permissions in the mailboxes affected checked. If access has occurred, the internal coordination of the response is being read as well; the follow-up should then initially be organised outside the systems affected.
File a criminal complaint and organise internal communication
File a criminal complaint and at the same time determine who is informed internally, who speaks with authorities and the bank, and how the staff involved will be dealt with. Assigning blame in this phase makes clarification more difficult, because it reduces the willingness to give a complete account.
Contact & appointments
Switzerland
Zürich
United Kingdom
London
Estonia
+372 6 288 2000
France
+33 2 04 26 81 82
Netherlands
+31 970 102 51606
Germany
+49 30 41733313
WhatsAppMessage us directly
Send a WhatsApp messageOverview
Why these messages work
The attack begins with research. From the commercial register, the website, the trade press and professional networks, directors, authorised officers (Prokuristen), signing authorities and the names in accounts payable can be assembled. Frequently knowledge from a mailbox that is being read along is added: ongoing projects, internal forms of address, the fact that management is currently travelling. The message that then arrives fits a real context.
In substance it follows a fixed structure: a confidential matter – a shareholding, a severance payment, a lawyers’ or notaries’ escrow account –, the request to depart exceptionally from the usual approval path, and a tight timeframe. Follow-up questions are devalued in advance by asking for discretion vis-à-vis everyone else. Increasingly, messages are backed by a telephone call or a voice message whose voice resembles the familiar one.
The payment typically goes to an account in another country, often in the name of a law firm or a holding company, and is redistributed within a short time. For the company this creates three topics at once: the recovery, the question of the security of its own systems, and the internal follow-up – which is frequently conducted under considerable pressure on individual members of staff and should therefore be carefully organised.
Recognising the signs
How a forged instruction can be recognised
The features are conspicuously constant. Anyone who has named them once recognises the structure even when the message is linguistically flawless.
- The message demands confidentiality vis-à-vis colleagues or superiors and justifies that with an ongoing transaction.
- The usual approval path is to be skipped exceptionally because it is supposedly urgent.
- The reply address differs from the familiar one or is redirected to an external address.
- The payment is to go to an account in a country with which the company maintains no business relationship.
- The alleged sender is demonstrably unreachable at that moment – travelling, in a meeting, abroad.
- A call or a voice message confirms the instruction, but evades follow-up questions and presses for execution.
- After the first payment a second, higher instruction with the same justification follows at short notice.
Possible measures
Possible measures
We separate the recovery, the technical clarification and the liability follow-up, because they have different deadlines and different addressees.
Support with the recovery
We draft the requests to the institutions involved, observe the deadlines and document the course of events for later use. A right to information against the payment service provider may come into consideration in order to identify the recipient.
Structured fact-finding in the company
We record the course of events with those involved, without turning the situation into disciplinary proceedings. The aim is a reliable chronology that can be used vis-à-vis the bank, the insurer and the authorities.
Examining responsibility in the internal relationship
Whether a breach of duty by staff or by corporate officers exists depends on the existing rules, how they were communicated and the specific course of events. A hasty determination regularly does harm – including because it can prejudge coverage questions vis-à-vis insurers.
Notification to insurers and the supervisory authority
Fidelity and cyber covers provide for short notification deadlines. If personal data or supervisory duties are affected, a further notification may come into consideration. We examine both and take over the correspondence.
Criminal complaint and coordination with the investigation
We prepare the payment trail for the investigating authorities. Because the same structures approach several companies, a connection to ongoing proceedings may be possible; an outcome does not necessarily follow from that.
Tightening the approval processes
What is often useful is a written rule that expressly excludes exceptions from the approval path, a callback duty via stored numbers, and an amount threshold with a four-eyes principle. We will draft such specifications on request.
Prospects
What can realistically be achieved
Whether the payment can be returned in whole or in part depends on where it went and who holds it at that moment. If the matter is noticed on the same day, a partial amount is occasionally still reachable; after onward transfer across several accounts and countries that is rare. We cannot promise an outcome, and recovery is the part of the case that closes most quickly.
The other levels remain open longer: the dispute with the insurer, possible claims against service providers whose duties were breached, and the question of responsibility in the internal relationship. These topics frequently decide the economic outcome more strongly than the recall, but they require careful documentation that must be laid down in the first days.
From our point of view, the most serious avoidable mistake after such an incident is not the payment itself, but a hasty internal determination of a blame question before the course of events has been clarified. The common foundations on evidence preservation, payment tracing and procedural routes are set out in the Fraud & Scam practice area.
Frequently asked questions
Frequently asked questions on CEO fraud
The answers describe typical situations in the company. What applies in your case depends on the internal rules, the course of events and the technical findings.
Related specialisms
Patterns that often overlap
Fraud rarely follows just one pattern. If your case only partly matches, related specialisms may help you understand the connections.
Fake Invoice
Manipulated invoices and changed bank details in the payment run – recovery, liability questions and process security.
Find out morePhishing
Forged bank and authority messages that harvest credentials – and what to do after an approval.
Find out moreCybercrime
Data theft, ransomware and attacks on corporate networks – preservation of evidence, notification channels and possible claims.
Find out more
Related information
Related information
- Fraud and scamsWhen fraud is suspected, payment routes, correspondence and timing are important starting points.
- Recognising signs of fraudUrgency, secrecy and extra payments before a promised withdrawal are recurring warning signs. A single feature does not replace examination of the facts.
- Fraud patterns at a glanceForged invoices, fabricated relationships and manipulated investment platforms follow different patterns. Explore how they work and possible next steps.
- Contact usDescribe your matter in a few sentences. Include only what is needed for the initial contact. Documents can be requested later through a suitable channel.
Contact
Describe your matter
An enquiry does not establish a client relationship or responsibility for monitoring deadlines. If a deadline is approaching, do not rely on this form alone.
- General information. The legal assessment depends on the circumstances of each case.