CEO fraud: how forged instructions reach the accounts department

The preparation uses what is in any case accessible: the naming scheme of e-mail addresses, responsibilities from the legal notice, commercial-register data, press releases about acquisitions, and absences from social networks. The timing is chosen deliberately — Friday afternoon, holiday periods, ongoing transactions.

Technically, a similar domain or a manipulated reply field is often enough. In more serious cases a mailbox is actually compromised; genuine conversations are then written into, which makes detection considerably more difficult.

Most losses arise not because rules are missing, but because they can be circumvented in the exceptional case. A four-eyes principle that is dropped in the event of urgency does not protect precisely when it is needed. What is effective are rules without an exception: a call-back to a stored number for every change of bank details, regardless of amount and sender.

For the assessment of a loss event it is additionally relevant whether these processes were documented. Both for insurance cover and for possible claims, what matters is what was provided for internally and whether it was complied with.

Time-critical are the recall via your own bank and informing the receiving bank. In parallel, the e-mail headers should be exported in the original, access to the affected mailbox examined and the internal approval chain documented. Depending on the facts, a criminal complaint, information claims against banks and a review of insurance cover may come into consideration.