A staff member receives an urgent email from the CEO asking for a confidential bank transfer. The email looks real — correct name, writing style, even a plausible backstory. The CEO is in a meeting and can't be disturbed. The transfer is made. The CEO never sent the email.
CEO fraud — a variant of Business Email Compromise where an attacker impersonates the organisation's leader — is one of the most financially damaging cyber attack types affecting NZ businesses. The FBI's Internet Crime Complaint Centre identified BEC as the highest-cost cybercrime type globally in 2023, with total losses exceeding $2.7 billion in reported cases. In New Zealand, CERT NZ regularly lists CEO fraud among the top financial loss incidents.
How the Attack Is Constructed
The attacker typically spends time researching the target before sending anything. They review the business's LinkedIn page to identify who the CEO is and who has financial authority (CFO, finance manager, office manager). They look at the CEO's writing style from any publicly available correspondence — conference quotes, press releases, LinkedIn posts. They identify current business events that might create plausible urgency — an acquisition, a legal matter, a quarterly close.
The email is then constructed to match that context. It comes from a spoofed address (similar to the real domain — yourcompany.co.nz becomes yourcompany-co.nz or yourcompanyco.nz), addressed to the person with payment authority, and creates a plausible reason for urgency and secrecy: "I'm in a board meeting. I need you to process an urgent payment before COB today. Don't mention this to anyone else — it's commercially sensitive."
Why It Works
The combination of apparent authority (the CEO) and apparent urgency creates social pressure that overrides normal verification instincts. Staff who would normally check with a colleague or verify a payment are reluctant to interrupt the CEO in a meeting, appear to doubt their authority, or seem incompetent by not being able to handle an "urgent" request independently.
Attackers deliberately target this psychological dynamic. The more senior the apparent sender, the greater the social pressure not to question the request.
The Simple Control That Stops It
A written policy with two elements stops CEO fraud almost completely: First, all payment requests above a threshold (set to whatever makes sense for your business — $1,000, $5,000) require verbal confirmation from the authoriser using a phone number already in your records. Second, payment requests received by email from any internal or external address are never acted on without this verification step, regardless of the apparent urgency or sender seniority.
The technical component: DMARC at p=reject (as covered in our email security article) prevents spoofed emails from your own domain reaching staff inboxes. But this doesn't stop lookalike domains — those require staff training and process controls.
CEO fraud succeeds because it exploits hierarchy and urgency simultaneously. A simple rule — verbal confirmation for any significant payment, using a pre-known phone number — costs nothing and makes the attack fail every time.
