Got a fake email impersonating the CEO asking for a company wire transfer, what to do against these attacks

happened to us too! the ceo email section was simply fake but nobody noticed. now we have a double signature rule no problems anymore

Protection from CEO Fraud: 1. Dual approval for all transfers 2. Phone verification (not via email links) 3. Set up DMARC/SPF 4. Train employees 5. Check the sender's email address

the email header actually fooled us. the address looked legit... edit: it was fake but who's gonna cheeck

How email spoofing works: Mail servers without SPF, DMARC, and DKIM configuration can send emails under other names.

How does a dual-approval mechanism work? For example, is approval required from both the accountant and the CFO?

great reflex! you could have lost a lot of money. cEO fraud costs companies over a trilion dollars

I'll argue the opposite, don't get mad. Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

Correct me if I'm wrong.

Ill try it.

Im curious too. Dont hesitate to ask; those who dont ask always pay more.

Good luck with that.

The most overlooked point about executive impersonation email is this: Hasty decisions become decisions you have to fix six months later.

If you have questions, write them; I'll answer as best I can.

You're right. If you scold false alarms, nobody will report again.

If you post the result here, it will help others too.

Three different views emerged, they all complement each other. The answer varies greatly by industry; there is no one-size-fits-all rule.

I'm also curious if anyone does it differently.

This approach has a cost, which isn't discussed. When we decide without measuring, we always end up in the same place.

An automated scan report is not the same as a penetration test. I'm also curious if anyone does it differently.

Let me summarize the topic since several different answers were given. I mean when making a decision first look at what data you have on hand.

Im also curious if anyone does it differently.

Three different views emerged they all complement each other. Mistakes made on the executive impersonation email side are usually reversible but expensive.

I'm curious too.

I went through the same thing two years ago. Most incidents start with a leaked password, not a vulnerability.

Just leaving this note, it might be useful.

How did you solve this? Having backups accessible on the same network and with the same identity makes them part of the target.