Executive impersonation

CEO fraud training that makes it safe to verify the boss.

CEO fraud works because people move fast when leadership asks. Training turns an urgent, secret request from the top into a signal to verify, and gives staff permission to do it.

Protect my team Browse the modules
Self-paced modules you buy once. Instant access after purchase.
text message
FromCEO (new number)
MsgAre you at your desk? I need a favor handled discreetly.
Buy gift cards for a client and send me the codes. Keep this between us.
Confirmed on a known number before acting
Illustrative example
how it works
How it works

What CEO fraud is and why authority works

CEO fraud, also called executive impersonation, is a scam in which an attacker poses as a senior leader and asks an employee to move money, buy gift cards, or share sensitive information. It is a form of business email compromise, and it can start from a spoofed address, a hacked mailbox, or a new phone number.

It works because people are trained to be helpful and quick when leadership asks. The attacker adds urgency and secrecy so the target feels there is no time to check and no one to ask. The message is often short, polite, and ordinary, which is part of the design.

warning signs
Warning signs

Warning signs of CEO fraud

These patterns show up again and again. One sign on its own is a reason to verify, not proof of fraud.

  • A request to pay, transfer, or buy gift cardsMoney or gift card codes are the most common goal. Be careful with any request for them outside the normal approval process.
  • Urgency combined with secrecyPhrases such as "keep this between us" or "I am in a meeting, handle it now" remove the chance to ask a second person.
  • A new channel for a familiar personA leader who normally emails suddenly texts from a new number, or writes from a personal address.
  • An address or number that is almost rightOne changed letter in a domain, or a display name that matches while the address does not, is a common trick.
  • Resistance to a quick checkThe sender cannot take a call, asks you not to confirm, or answers questions with more pressure.
in the moment
In the moment

What to do when the boss asks for something unusual

A real leader can survive a thirty second check. A scam usually cannot.

  1. Pause before you actTreat urgency and secrecy together as a reason to slow down, not speed up.
  2. Verify on a channel you already trustCall the person on a number from your directory or contacts, not the number in the message.
  3. Ask a second personCheck with a manager, finance lead, or assistant. A legitimate request survives a second look.
  4. Hold the money and the codesIf the request cannot be confirmed, do not proceed, even if the sender pushes back.
  5. Report the attemptTell IT or security so colleagues can be warned and the message can be examined.
The training

CEO fraud training your whole team can take

These AwarenessCORE modules are self-paced and each ends with a graded assessment.

Phishing AwarenessCovers targeted fraud such as business email compromise, and how to verify, report, and recover.The psychology attackers use, reading an email like an attacker, attacks that arrive by text, phone, QR code, and fake MFA prompts, targeted fraud such as business email compromise, and how to verify, report, and recover.View module and price ›Security Awareness EssentialsCovers social engineering beyond phishing, and the policies, reporting, and culture that make verification normal.Core security habits: the human layer, social engineering beyond phishing, accounts, passwords and MFA, devices and workspace, working safely anywhere, and policies, reporting, and culture.View module and price ›

Browse all modules and prices

A dedicated module on this topic is coming soon. See the Coming soon card.

Questions teams ask

Questions about CEO fraud training

What is CEO fraud?

CEO fraud is a scam where an attacker impersonates an executive to pressure an employee into sending money, buying gift cards, or sharing information. It is also called executive impersonation and is a type of business email compromise.

How is CEO fraud different from regular phishing?

Regular phishing often relies on a link or attachment sent to many people. CEO fraud is usually targeted and may contain no link at all. It relies on authority and a believable request instead.

Why are finance teams and assistants common targets?

Attackers aim at people who can move money or share sensitive information, and who are used to acting on requests from leadership. Training helps these roles verify without feeling that they are being disloyal.

What if the request really is from the boss?

Verifying is still the right move. A real executive will understand a quick confirmation, and a clear verification rule protects everyone. Organizations do best when leaders say openly that they expect to be checked.

Can training alone stop CEO fraud?

Training builds the habit, but it works best alongside process controls such as callback verification and approval limits for payments. No training can guarantee that every attempt is caught.

Know the signs

Know the signs beyond CEO fraud

A quick reference: the first warning sign from each of the ten threat pages. Each chip opens the full list and what to do.

PhishingThe sender and the address do not matchCEO fraudA request to pay, transfer, or buy gift cardsFake invoice scamsChanged bank detailsSmishingA message from a number you do not knowSocial engineeringA caller who creates urgencyRansomwareAn unexpected attachment or downloadInsider threatsData shared more widely than neededPassword securityThe same password in many placesWire fraudNew or changed payment instructionsAccount takeoverVerification prompts you did not start

Give your team permission to verify the boss

Tell us your team size and we will suggest which modules fit. A real person replies, usually within one business day.

  • A real person, not a bot, within one business day
  • Straight answer on cost and what fits your team size
  • No pressure to buy

Get a callback

Tell us about your team and we will follow up.
Rather move now? Browse the modules ›

Got it. We will be in touch.

Someone from AwarenessCORE will reach out within one business day.

What every module includes

  • A graded knowledge check with a pass mark
  • A completion certificate when you pass
  • Access that does not expire
  • One payment per module, no subscription

Built by TheBRHub, an IT and email security company in Carlsbad, California.

Protect your team from CEO fraudGet started