What is CEO fraud? A guide to protecting against fake IBAN emails

How is CEO fraud set up?

The attack generally unfolds in three stages, and each stage requires patience. The first stage is reconnaissance: the attacker examines the organization's website, social media accounts, press releases, and public commercial records. They learn the names of executives, accounting and purchasing staff, regularly used suppliers, and even when an executive will be traveling.

In the second stage, a sender that looks trustworthy is prepared. This can be a newly registered domain that differs from the real one by a letter or two, a free email address whose display name is the general manager's name, or a real supplier account whose password has been compromised. The last method is the most dangerous, because the email genuinely comes from a familiar address.

In the third stage, the email is sent, and it is usually short, urgent, and personal: "I'm in an acquisition meeting and can't take calls; this payment needs to go out today" or "Our bank has changed, make future payments to the IBAN below." The email's sole purpose is to get the employee to act quickly, bypassing the usual checks.

Why do fake IBAN emails get past filters?

A fake IBAN email is technically clean in most cases. It contains no malware or suspicious links. If the attacker has registered their own look-alike domain, they may also have correctly configured its SPF, DKIM, and DMARC records; in that case, the authentication checks pass.

Spam filters are designed to catch bulk mailings and known malicious content. They struggle to distinguish a payment request written to a single person and personalized with the right names. That's why protection has two layers: technical checks that measure who actually sent the email, and an internal process that verifies the payment instruction through an independent channel. Neither one substitutes for the other.

What signs indicate an email might be fake?

• Look-alike domain: ornek-lojistik.com.tr instead of ornek-lojistlk.com.tr such as a difference of one or two letters, or letters from a different alphabet that resemble Latin letters.
• Display name and address mismatch: the display name is the general manager's name, but the address belongs to a free email service.
• A different reply-to address: the email appears to come from a familiar address, but clicking "Reply" sends the response to a different address.
• Urgency and secrecy pressure: phrases like "right now", "must be today", "don't tell anyone", "I can't take calls right now".
• Payment information change: a notification by email that a previously used supplier's banking information has changed.
• Deviating from the usual flow: a first-time high-value payment to a new account, a request to skip approval steps, or sending at unusual hours.

Any single one of these signs doesn't always mean fraud; but when two or more appear together, the payment must be stopped and verified.

How does an organization protect its payment process?

1. Don't accept an account change by email. If a supplier's banking information has changed, confirm it by calling the previously verified phone number on file. Don't call the number given in the email.
2. Require a second approval for payments. Every payment above a certain amount, or to a new account, should go through a second person's approval.
3. Don't define an exception for urgent payments. The same verification should apply to requests marked "urgent" too; urgency should never be a reason to skip the check.
4. Protect your domain. Fully configure SPF, DKIM, and DMARC records for your own domain; this makes it harder for fake emails to be sent in your name.
5. Brief employees briefly and regularly. Introduce these red flags to accounting and purchasing teams with real examples; a short reminder every quarter works better than one long training session a year.
6. Open a way to report suspicious mail. Make it clear who an employee should tell, and how, when they think "I'm not sure about this email"; the person who reports it should never be blamed.

What should be done if a suspicious payment has already been made?

1. Call your bank immediately and ask them to stop or recall the transfer; the first hours are decisive.
2. Ask your bank to notify the receiving bank as well.
3. Do not delete the email, its attachments, or the correspondence history; keep them with full headers.
4. Change the passwords of any accounts that may have been compromised and close open sessions.
5. Report the incident to law enforcement and log it internally within the organization.
6. After the incident, identify which control was skipped in the process and fix it.

How do employees learn to recognize this attack?

The most effective method is short sessions built on realistic examples. Show the accounting team a fake IBAN email from your own sector and find the red flags together. Then answer the question "what would you do if you received this email" with concrete steps: who you would call, which record you would check, who would approve the payment.

The rule should be kept simple: "Any change to payment details or urgent payment request is always verified by phone." A short, memorable rule works better than a long policy document.

Managers must follow this rule too. When a general manager tells employees "urgent payment instructions from me will also be confirmed by phone," the authority pressure that is the attacker's strongest lever disappears. When the rule applies to everyone, the employee doing the verification doesn't feel awkward about it.

How does SmartMail protect against CEO fraud?

SmartMail measures the traces of CEO fraud as separate signals rather than a single verdict, and writes out the result with its reasoning. SmartMail recalculates the sender's SPF, DKIM, DMARC and PTR records for every incoming email. A look-alike domain, a domain written in a different alphabet, display-name spoofing and a mismatched reply-to address are flagged as separate findings. The text is also evaluated for indicators such as payment requests, organization impersonation and urgency pressure.

The result is a readable security assessment shown alongside the email: "The display name claims to be your organization, but the address is external" or "the domain has been made to resemble a known contact." Mail below the trust threshold is quarantined.

On the payment side, SmartMail's send-approval flow ensures that critical correspondence going out under the organization's name passes the approval of one or more colleagues. Details: SmartMail email security and email approval flow.

Frequently asked questions

Does CEO fraud only target large companies?

Small and medium-sized businesses are frequently targeted too; since the payment decision often rests with a single person at these businesses, the attack succeeds more easily.

Does an email passing SPF and DKIM checks mean it's safe?

No, it doesn't. These checks only verify that the email came from the domain it claims to be from. If the attacker has registered and configured their own look-alike domain, the checks pass; you also need to look at the domain itself.

How do you recognize a fake request sent from a supplier's real account?

Emails from compromised accounts are technically valid. The process is what matters: always verify an account change through an independent channel, using the registered phone number.

I replied to a fake IBAN email but didn't make the payment; is there a risk?

There is no direct harm, but the attacker learns that your address is active. Stop the correspondence, forward the email to your IT lead, and notify the supplier using their registered number.