1. Introduction

CEO fraud is the best-known form of Business Email Compromise (BEC): an email that appears to come from senior management orders an urgent transfer, and the victim executes it. But BEC is much more than that final click: it is an industrialized fraud that in 2024 exceeded ransomware in direct economic damage, according to FBI IC3 statistics, and it targets mainly the company’s payment process.

In this article we explain how it works, why the corporate mailbox is the stage of the fraud and which eight controls your company needs before an employee presses “accept transfer”. The goal is practical: make sure the organization knows exactly which checks to perform, who performs them and in what order, before moving a single euro.

2. BEC and CEO Fraud in Numbers

The FBI IC3 recorded losses above $2.77 billion from BEC in 2024 in the United States alone, with more than 21,000 complaints, ahead of ransomware in direct economic damage. The average fraudulent transfer is around $128,980, and most frauds are not detected at the moment of the transfer but weeks later, when the real supplier claims its payment.

The difficulty of CEO fraud is that it breaks no technological barrier: it breaks trust. The attacker does not exploit a vulnerability in the payment gateway; they exploit hierarchy, urgency and the lack of a verification procedure. AI makes it worse: voice cloning needs only a few seconds of audio, and deepfakes in video calls have already produced frauds of $25 million, like the Hong Kong case of February 2024 featuring a fake CFO.

3. The FBI’s 5 Modalities

The IC3 groups BEC into five recognizable modalities. Knowing them is the first defense, because each one attacks a different link in your organization:

Modality	Who is impersonated	Objective
CEO fraud	Director or executive	Urgent transfer approved through hierarchy
Vendor fraud (VEC)	Regular supplier	Diversion of a real invoice to their own IBAN
Bank account update	Supplier in communications	Fraudulent update of the archived IBAN
Attorney impersonation	Law firm in M&A, estates or trials	Payments under legal pressure
W-2 fraud	Management toward HR	Tax and payroll data of the whole workforce

Fig. 1 – The five BEC modalities defined by the FBI IC3.

The first two are the most profitable: CEO fraud pressures with authority and confidentiality, while vendor fraud steps into the legitimate thread of an already expected real invoice. The bank account update variant deserves special attention because it does not require urgency: the real supplier ends up paying to another account for months.

Attorney impersonation flourishes in complex transactions — acquisitions, inheritances, litigation — because the law firm itself demands confidentiality, which makes the victim hesitate to verify. W-2 fraud is the cheapest to execute for the attacker and the most damaging for the company: a single message to HR delivers the tax data, salaries and personal details of the entire workforce, which later fuels phishing, identity theft and extortion against employees.

4. EAC vs BEC: The Compromised Mailbox Precedes the Transfer

Every fraud with a compromised account involves a previous technical phase that the FBI calls EAC (Email Account Compromise): the attacker enters the mailbox — through phishing, credential stuffing, brute force against OWA or IMAP without MFA, infostealers or malicious OAuth apps — and operates silently for weeks. Not all BEC requires EAC, because some modalities use similar domains (typo-squatting), but when EAC exists, the silent phase determines the success of the fraud.

In that phase the attacker learns: who approves payments, which suppliers bill regularly, when monthly cycles close and what the internal approval flow looks like. Then they create automatic forwarding rules to an external account, move emails to hidden folders and wait for the real incoming invoice to hijack the thread at exactly the right moment. You can see in detail what happens when a corporate account falls into an attacker’s hands in our article about what can happen if corporate accounts are stolen.

5. The 8 Controls Before You Press Accept

Preventing CEO fraud is not purely technical: it is a system of controls that support each other. These are the eight we recommend implementing, described in detail in the book “Protocolos y procedimientos prácticos de ciberseguridad” (Confemetal, 2026):

1. Phishing-resistant MFA on email and payment-approving accounts: SMS, TOTP and push fall to AiTM attacks; FIDO2/passkeys do not.
2. DMARC p=reject with strict SPF and signed DKIM: eliminates direct impersonation of your own domain, and of suppliers that adopt the standard too.
3. Advanced email protection: attachment sandboxing, URL rewriting, lookalike domain detection and a visible external sender banner.
4. OAuth app governance: block user consent for third-party apps and approve every grant from administration.
5. Out-of-band verification of any bank detail change: call the number archived in the system, never the one in the email.
6. Dual approval for transfers above a threshold, with segregation of duties between creator and validator.
7. Active SIEM rules: automatic forwarding rules, impossible travel, logins from unusual geographies and unknown OAuth apps trigger alerts.
8. Urgency policy: “urgent and confidential” is a fraud indicator, not an exception to the procedure, with periodic bank reconciliation.

Fig. 2 – The eight anti-BEC controls a company should have in place.

The ninth control, the only one that can prevent the loss even when the entire technical layer has failed, is the process: verification is performed always, on every transfer, and no title or message can bypass it. Technical controls reduce the probability of the attack; the process reduces the probability of the damage. That is why the strongest programs train the whole payment chain — finance, purchasing and executive assistants — together and run the verification drills as part of onboarding, not as an annual reminder.

6. Out-of-Band Verification: The Control That Saves the Most Money

Out-of-band verification is the most specific piece of payment process hardening. The rule is simple: no bank detail update is accepted from the email itself, nor from an attached document, nor from an incoming call. You call the supplier at the official number already archived in the ERP or CRM; if the email comes from the CEO ordering “maximum urgency”, the same procedure applies with the director’s registered contact.

# Out-of-band verification checklist for an IBAN change
1. Locate the IBAN archived in the ERP/CRM (never the one in the email)
2. Call the officially registered supplier number
3. Confirm verbally: new IBAN, account holder, amount and date
4. Log the call: date, time, interlocutor and outcome
5. Approve the change only if the verification confirms the data
6. If confirmation is not clear, hold the payment

Fig. 3 – Minimum out-of-band verification procedure for bank detail changes.

The procedure becomes ritual: two people for payments above the threshold, auditable verification records and decreasing thresholds during exposure periods such as bank migrations or external audits. Periodic bank reconciliation closes the loop: it detects the diversion when the real supplier complains, and that early detection is what makes money recoverable.

7. Technical Detection: SIEM and Safeguards

Early detection requires visibility over the mailbox and the directory. The most cost-effective SIEM rules mirror anomalous behavior: creation of forwarding rules without intervention, an OAuth grant by an unknown app with email read permissions, logins from incompatible geographies — an impossible Madrid-Hanoi trip in five minutes — or mass searches for “invoice”, “IBAN” or “payment” in the mailbox. Emptying the trash and enabling IMAP/POP3 without precedent are also typical signs of accounts being prepared for fraud.

Remember that a malicious OAuth token survives a password change until it is revoked manually, so consent review is a routine part of mailbox hygiene. When an account falls, the response procedure is documented: revoke all sessions, rotate credentials, re-enroll MFA and audit what was seen, searched and downloaded, as explained in the actions after the hijacking or loss of credentials.

Do not underestimate the value of the cloud audit logs: Microsoft 365 and Google Workspace record every mailbox rule creation, session revocation and OAuth grant, and both platforms offer tools to review active sessions and sign out compromised users remotely. A weekly automated review of those logs, even a simple export script compared against a baseline, is what turns vendor claims like “we never received the invoice” into early detections instead of post-fraud discoveries.

8. Response When the Transfer Has Already Been Executed

If the fraud is consummated, time is the only resource that matters: most successful recoveries happen within the first 24-72 hours. The sequence is: notify the bank immediately with the destination account, amount, date and reference, requesting cancellation or blocking if the transfer has not settled; file a complaint immediately with the police — in Spain, Policía Nacional or Guardia Civil — since account blocking is only viable within the first hours; and activate the FBI’s Financial Fraud Kill Chain if the destination account transits through the United States.

In parallel, mailbox forensics establishes the scope of the EAC, the insurer is notified within contractual deadlines — Crime, Social Engineering Fraud and Computer Fraud policies cover these scenarios — and notification to the data protection authority within 72 hours is prepared if personal data is involved (Article 33 GDPR and, where applicable, NIS2). From a criminal law perspective, this is computer fraud covered by Article 248 of the Spanish Criminal Code.

9. Conclusion

CEO fraud and BEC in general are the most expensive fraud a company can suffer through the email channel, and the only control that guarantees stopping it is a hardened payment process with out-of-band verification and dual approval. The other seven controls reduce the probability that the attack is executed; that eighth one turns human error into a minor incident.

The eight pieces of the system are well known and affordable: FIDO2 MFA, DMARC p=reject, email protection, OAuth governance, out-of-band verification, dual approval, SIEM rules and an urgency policy. What separates victims from non-victims is not technological sophistication, but the discipline of applying the controls every single day, also when the message says “urgent and confidential”.

Need help with CEO fraud?

At Jaymon Security, we help organizations protect their systems. From security audits to SIEM/SOC implementation, our expert team designs custom solutions.

Contact us for a free infrastructure assessment.