2.4CEO fraud & wire transfer fraud
The essentials in 30 seconds
- Urgency + secrecy + transfer = FOVI until proven otherwise — the trio is not discussed, it is verified.
- “Tell no one” = absolute signal: isolating the victim is fraud's precondition — imposed secrecy is the alarm.
- Dual approval + known-number callback: any unusual transfer or bank-details change is verified via another channel — checking is not disobeying.
Threaded mini-case — Karim and the fake “CEO” email
Karim receives an email seemingly from the CEO: exceptional, confidential transfer of 25 000 € to execute urgently, “tell no one”. The urgency + secrecy + transfer trio triggers his FOVI reflex: instead of obeying the imposed secrecy, he applies the procedure — calling the CEO back via the internal directory on the already-known number. The CEO never asked for anything. Karim reports the attempt: verification via another channel just saved the company.
Simplified teaching model: this scenario illustrates the signals and the defense, without detailing any attack technique.
1. The Fake Wire Transfer Order
CEO fraud (FOVI — Fake Wire Transfer Order) targets accounting and finance departments: an urgent call or email seemingly from the CEO or CFO, requesting an exceptional, confidential transfer. Most frequent variant: fake-supplier fraud (bank-details change: subsequent payments go to the fraudster). With AI, these frauds now also include voice and video deepfakes.
2. Red flags
Urgency + secrecy + transfer = FOVI until proven otherwise. Imposed secrecy (“tell no one”) is the absolute signal: isolating the victim is fraud's precondition. And even the executive's real address proves nothing: compromised account or spoofed address — it is the nature of the request triggering verification, not the address.
3. Defenses
Dual approval: any unusual transfer or bank-details (RIB) change requires a second approval via a different channel. The known-number callback: check with the requester via the ALREADY-known number (internal directory) — never the one given in the request. No real executive will ever blame a verification — fraudsters will.
🔎 Concrete example — 🔎 Concrete example — Testing your payment circuit
Karim's test, before fraud strikes (teaching model):
A “CEO” requests an urgent confidential transfer of 25 000 €.
Supplier bank-details change → callback on the HISTORIC number?
Rule: unusual payment = verbal check on the known number.Takeaway: the payment circuit scrutinized, dual approval anchored.
Lesson: verify even (especially) when the message forbids it.
Section vocabulary
- CEO fraud (FOVI)
- Fake Wire Transfer Order: a fraudster impersonates an executive and demands an urgent, confidential transfer.
Simple example: The fake “CEO” email Karim received: urgent, confidential 25 000 €.
What it is not: a planned, documented transfer approved under the usual procedure.
Reflex: urgency + secrecy + transfer trio = immediate verbal check.
- Fake-supplier fraud
- The “supplier” reports a bank-details change: subsequent payments go to the fraudster — the most frequent variant.
Simple example: An email announcing new bank details (RIB) to use “from the next payment”.
What it is not: bank details verified by callback on the supplier's historic number.
Reflex: any bank-details change = callback on the already-known number.
- Imposed secrecy
- “Tell no one”: the absolute alarm signal — isolating the victim is fraud's precondition.
Simple example: The fake CEO's gag order, which Karim disobeys to check.
What it is not: a real procedure precisely providing for a second approval.
Reflex: imposed secrecy = tell someone (contact, hierarchy) at once.
- Dual approval
- The organizational defense: any unusual transfer or bank-details (RIB) change requires a second approval via a different channel.
Simple example: Karim has the 25 000 € transfer approved via a second channel first.
What it is not: executing an urgent transfer alone “not to bother anyone”.
Reflex: never an unusual payment without second approval.
- Known-number callback
- Check with the requester via the ALREADY-known number (internal directory) — never the one given in the request.
Simple example: Karim calls the CEO on the directory number: no real request.
What it is not: calling back the number given in the suspicious message itself.
Reflex: internal directory and historic numbers always at hand.
In practice — In practice — Testing your payment circuit against FOVI
- Run the scenario: a “CEO” email asks you for an urgent, confidential 25 000 € transfer. Who, in your organization, could actually execute it alone?
- Check the supplier bank-details change procedure: does it require a callback on the supplier's historic number? If not, propose it.
- Formalize your personal reflex: any unusual payment request = verbal check on the known number, even (especially) when the message forbids it.
- Share the scenario with whoever handles payments — this 5-minute conversation is the company's best defense.
Ready-to-say script — opposing procedure to the fake CEO (20 s)
“Dear Director, I have received your urgent, confidential request. Our procedure requires dual approval for any unusual transfer: I'll call you back in a moment on the directory number to confirm together, and have it approved via a second channel.”
Say (or write) then really call back on the known number; never execute alone, even under pressure.
Copy-paste template — unusual-transfer check
REQUEST RECEIVED ON: _______________ / AMOUNT: _______________
FOVI TRIO (urgency + secrecy + transfer)? YES / NO
BANK-DETAILS CHANGE? YES → callback on HISTORIC no.: _______________
DUAL APPROVAL (2nd person + different channel): _______________
DECISION: verbal check on the known number BEFORE any paymentSmall business with no accounting department
The manager applies the rule themselves: any changed bank details = call to the supplier on the historic number.
SME in Algeria
Karim has dual approval written into the internal procedure and keeps the directory up to date.
Large company / finance
Multiple approval thresholds and separate mandatory channels for sensitive amounts.
Voice / video deepfake
Even with the “CEO's voice”: hang up and call back the known number — voice proves nothing either.
✓ Best practices
- Treat urgency + secrecy + transfer as FOVI.
- Verify any bank-details change by callback on the historic number.
- Require dual approval for unusual transfers.
✗ Common pitfalls
- Taking the executive's real address as proof (compromised/spoofed account).
- Obeying imposed secrecy without checking.
- Executing an urgent transfer alone, with no second channel.
Key takeaways
- Urgency + secrecy + transfer = FOVI until proven otherwise.
- Any supplier bank-details change is verified by callback on the HISTORIC number.
- Checking via another channel is not defiance: it is the procedure protecting everyone.
- No real executive will ever blame a verification — fraudsters will.
48h Challenge - apply tomorrow
Test your circuit: who could alone execute a 25 000 € transfer at your place? Check the bank-details procedure (historic callback?) and share the scenario with whoever handles payments.
- I can quote the FOVI trio and the absolute signal.
- I can apply dual approval + historic callback.
- I tested my payment circuit on the scenario.
Frequently asked questions
The email came from the executive's REAL address: how is that possible?
Either the account is compromised, or the address is spoofed — in both cases, the address is not enough: it is the nature of the request (urgent, confidential, unusual) triggering the verbal check.
A fraudulent transfer has gone: can it be recovered?
Every minute counts: immediate call to the bank to request a recall of funds, police report (complaint), insurance notification. The first hours offer a real blocking chance — after 48h, it collapses.
Karim receives: urgent transfer + “tell no one”. What verdict?