The most expensive cyberattack in an SME often needs no malware. An email from apparent management, an urgent payment, a supplier’s new bank details: the money is transferred before anyone asks. Phishing and CEO fraud target people and processes, not technology. The best protection therefore lies in processes.
How CEO fraud unfolds
Attackers research first: who is the managing director, who triggers payments, which suppliers exist, when is the boss travelling? Much of this is on the website, in the commercial register and on social networks. Then comes a message, apparently from management or a lawyer: a confidential acquisition, a payment that must go out today, please tell nobody. Sometimes the message really comes from a supplier’s genuine mailbox that was taken over earlier and contains new bank details for the next invoice.
Why training alone is not enough
Modern fraud messages are linguistically flawless, well timed and tailored to the person. Even trained employees fall for them when pressure, authority and a plausible occasion coincide. Security awareness matters, but it is the last line of defence, not the first.
Processes that protect
- Call-back on bank details: every change of bank details is confirmed by phone via a known number, never via contact details from the message itself.
- Four eyes on payments: payments above a threshold and all payments to new recipients need a second approval (four-eyes principle).
- No exceptions by email: instructions to bypass normal processes are always verified on a second channel, even when they come from management.
- Explicit backing: management states in writing that nobody will be criticised for verifying one of its instructions.
Technical measures
Multi-factor authentication prevents stolen passwords from leading to mailbox takeovers. DMARC, SPF and DKIM prevent attackers from using your own domain as sender. Tags for external emails and warnings for look-alike domains help recognition. A rule reporting automatic forwarding from mailboxes to outside addresses detects taken-over accounts early.
When it has happened
Call your bank immediately and request a recall of the payment; the faster, the better the chance. The recipient bank is informed via your own bank. File a criminal complaint and secure affected accounts, in particular change passwords and check forwarding rules. If a mailbox was taken over, personal data may have leaked; check the duty to notify the FDPIC (data breach notification). Critical infrastructure operators also check the Swiss reporting obligation.
Context
CEO fraud is not a sign of negligence but professional crime. Companies with fixed payment processes and employees who dare to ask are much harder to hit. Our Microsoft 365 security checklist reviews the technical baseline; all cyber content is collected in the cybersecurity topic page.