Sender Registry
Is this email really from your boss? How CEO fraud works.
CEO fraud has a very specific shape: an urgent email that appears to come from your chief executive, a director, or a senior manager, asking you to move money, pay an invoice, or buy gift cards, quickly and quietly. It carries no dodgy link and no attachment, which is exactly why it slips past the filters. It works on authority and pressure instead. Here is how to recognise it, and what to do.
What it looks like
It is usually short, urgent, and personal. It knows your name and your boss's name, and it often opens by checking you are available before the real request arrives.
Are you at your desk? I need you to sort something for me before I go into a meeting. Let me know once you are free and I will send the details. Keep this between us for now. Thanks.
Why it works
There is no malware to catch, so a filter sees an ordinary email. What makes it dangerous is human. It uses the authority of a senior name, the pressure of a deadline, and a request for secrecy that stops you checking with anyone else. By the time the second email arrives with the payment details, you are already primed to help.
The red flags to check
- An unusual request from a senior person, especially about money, a payment, or gift cards.
- Urgency, plus a reason you cannot verify it, such as they are travelling, in a meeting, or hard to reach.
- A request for secrecy, or to bypass your normal payment process.
- A close lookalike address, or a display name that does not match the real address behind it.
- A reply that would go somewhere different from where you expect.
How to check before you act
Never verify the request by replying to the email. Contact the person directly on a channel you already use, a phone call, a text, or a walk to their desk, and confirm out loud. A genuine manager will support the check. Your organisation's payment process exists for exactly this moment, so use it even when the request seems to come from the top.
Got one of these? Forward it, free.
Send it to Sender Registry and we assess the sender, the domain, and what the wider network already knows about it. No account, no card. You get a plain-English verdict back.
Common questions
What is CEO fraud?
It is a scam where a criminal poses as a senior person in your organisation, often the chief executive or a director, and emails a member of staff with an urgent request: pay an invoice, move money, buy gift cards, or share confidential details. It is also known as business email compromise, or BEC.
How is it different from ordinary phishing?
Ordinary phishing casts wide and hopes. CEO fraud is targeted and personal. The criminal has usually worked out who reports to whom, picks a moment such as when the boss is travelling, and writes a short, plausible message with no link and no attachment, which is exactly why it slips past filters that look for those.
The email really is from my boss address. Can it still be fraud?
Yes. If the account has been compromised, the message genuinely comes from their address. More often the address is a close lookalike, or the display name is right while the real address behind it is not. Either way, an unusual request should be confirmed with the person directly, never by replying.
My boss is asking me to buy gift cards urgently. Is that a scam?
Almost certainly. A request to buy gift cards, read out the codes, and keep it quiet is one of the clearest signatures of CEO fraud. No genuine executive settles a business need with gift cards. Stop and confirm with them in person or by phone before doing anything.
More on recognising a suspicious email: how to spot a phishing email →