CEO fraud: typical scenario and dual approval

CEO fraud is a scam in which a caller poses as the chief executive or a supplier. They ask for an urgent, confidential wire transfer to an account they control. In France it falls under fake wire transfer order fraud (known as FOVI). For accounting and treasury teams, the defense comes down to one rule: no unexpected wire transfer and no change of banking details without independent approval.

This article describes a typical scenario, the variants, the dual approval procedure and the sentences to say to the caller.

What is CEO fraud?

The French agency Cybermalveillance.gouv.fr defines fake wire transfer order fraud as a scam that aims to get an unplanned wire transfer made. It uses persuasion, threats or various forms of pressure. When the request is presented as coming from a senior executive, with an “urgent and confidential” character, it is called a CEO scam (in France, “arnaque au Président”).

Its fact sheet specifies that this fraud is generally carried out by phone, by electronic messages, or both. It affects every type of organization. When the request arrives by email, US teams know it as business email compromise (BEC). The fraudster's bank account is often located abroad.

In its 2025 activity report, Cybermalveillance.gouv.fr notes that wire transfer fraud is intensifying (up 170%). It has spread to e-invoicing and payroll management.

A typical CEO fraud scenario by phone

Here is a scenario built to illustrate the mechanism. It describes no real case.

Picture an accounts payable clerk, Emma, on a Friday at 4:30 p.m.. Her phone rings. The caller introduces himself as the CEO, traveling: “I’m in a confidential meeting, an acquisition is under way. I need a wire transfer today, before the bank closes. I’m sending you the details by email.”

He adds: “Don’t mention it to anyone, including the CFO. I’m counting on you.” A few minutes later, an email arrives with the banking details and a forged approval.

All the levers are there:

• the executive's authority;
• the urgency of the bank's closing time;
• confidentiality, which isolates the victim from colleagues;
• flattery: “I’m counting on you”.

These levers are analysed in our article on social engineering levers.

The variants: fake supplier, banking details change, fake employee

The Cybermalveillance.gouv.fr fact sheet describes two other forms.

• The fake supplier: the fraudster impersonates a supplier to provide new banking details to which payment must be made.
• The fake employee: the fraudster impersonates an employee to request a change of the banking details to which their salary is paid.

The fake supplier is often more discreet than the fake CEO. The call is ordinary: “We’ve changed banks, here are our new banking details.” Nothing is urgent, nothing is confidential. It is routine that lulls vigilance.

In some cases the fraud follows the hacking of the impersonated person's mailbox, which makes the exchange very credible. The phone is then used to confirm the request, relying on real information.

The dual approval procedure

The fact sheet recommends an internal management approval procedure with no exceptions. It targets unexpected wire transfer requests and changes of banking details. Here is one way to put it into practice.

1. Qualify the request. Any unexpected wire transfer, any change of banking details and any “confidential” request triggers the procedure.
2. Call back. The accountant calls the requester back on a number already known to the organization, never the one given by the caller or shown in the email received.
3. Have a second person approve. Another authorized colleague checks the request before execution, even if the request comes from an executive.
4. Keep a record. The time, the number displayed, the name given and what was requested are noted.
5. Execute or refuse. In case of doubt, suspend and alert the security officer.

For its part, the French data protection authority (CNIL) recommends contacting by phone or in person the company's known contacts who are making the request. It also advises reminding teams of the procedures regularly, because a forgotten rule is no longer applied.

The callback is the central habit. It is explained in detail in our article on the callback procedure through an independent channel.

The signals that should trigger the procedure

None of these signals proves fraud. Together, they justify switching to verification mode.

• The wire transfer was not planned and has no associated purchase order.
• The beneficiary is new, or the account is located abroad for no apparent reason.
• The request is “urgent and confidential” and excludes the usual colleagues from the process.
• The caller refuses to be called back or offers to stay on the line during the operation.
• The accompanying email comes from an address close to the usual one, but not identical.

The CNIL describes the same pattern on the email side: an urgent request, supposedly approved at the highest level. The domain often resembles the company's own.

Why experienced accountants give in

It is not a lack of skill. The accountant who takes the call is placed in an uncomfortable position. They have to refuse an executive, risk delaying a strategic operation and decide alone. The fraudster exploits precisely this fear of getting it wrong.

The confidentiality requested is the key to the scheme. It stops the victim from talking to a colleague, who might have recognized the scam in thirty seconds. A simple rule follows: any request that forbids you to talk about it must be shared with your manager.

For this rule to hold, management must state it clearly. A message such as “nobody in the company, myself included, can ask you for a wire transfer outside procedure” protects the teams. It gives them permission to refuse before the call even happens.

What to say to the caller without offending them

The difficulty is social. Refusing an executive is delicate, especially on the phone. The rule must therefore give the employee a sentence that does not challenge the person.

“For any wire transfer outside procedure, I have to get a second approval. I’ll call you back in five minutes on your usual line.”

“I understand the urgency. The rule applies to every wire transfer, and it was set by management.”

“For new banking details, I need written confirmation and a call to your usual contact.”

A genuine executive approves these sentences, since they signed off the procedure. A fraudster protests, flatters or threatens. Our article on how to say no on the phone under pressure develops these techniques.

If the wire transfer has already gone

Every hour counts. Cybermalveillance.gouv.fr recommends the following steps.

1. Identify all wire transfers executed, pending or upcoming to the fraudster, and alert management and the accounting department.
2. Ask for the wire transfer to be suspended if it has not yet been executed.
3. Alert the bank to request the return of the funds. The bank may require a police complaint to be filed.
4. Keep the evidence: phone numbers, messages, wire transfer orders, invoices.
5. Change the mailbox password if it may have been hacked.
6. In France, file a complaint at the police station or gendarmerie.

To know what to retain from the call while it is happening, see our grid for reporting a security incident.

Training accounting teams to hold to the procedure

A written procedure does not guarantee it will be applied under pressure. An employee who hears “the CEO” on the line acts differently from when they read the instruction. Spoken practice closes that gap.

With Face Up, a trainer writes the scenario from their real cases. The learner speaks to a persona playing the fake executive, with its follow-ups, and must apply the procedure live. The debrief plays back their own sentences. They can play again until they hold the refusal. This approach is described in our guide to cybersecurity awareness training.

Frequently asked questions

What is the difference between CEO fraud and a fake supplier?

In the first case, the fraudster impersonates an executive and creates urgency. In the second, they impersonate a supplier and ask for a change of banking details, often with no apparent urgency. The result is the same: a wire transfer to the fraudster's account.

Is dual approval enough?

It is effective if the second approver really checks the request through an independent channel. If both people rely on the same email or the same call, dual approval becomes a mere rubber stamp.

Is CEO fraud punishable?

Yes. According to Cybermalveillance.gouv.fr, under French law the scam carries up to five years in prison and a fine of 375,000 euros. An attempt is punished by the same penalties (articles 313-1 and 313-3 of the French Criminal Code).

To have your treasury and accounting teams rehearse this procedure, book a Face Up demo.