CEO fraud and invoice fraud: “Can you transfer this today?”
CEO fraud targets whoever makes the payments: the bookkeeper, the office manager, the assistant. The e-mail comes from “the boss”, is confidential and urgent. Losses per case run into the tens of thousands.
Two variants. In CEO fraud someone posing as the director e-mails (or messages): an urgent payment for an acquisition, a secret deal, “I am in a meeting, just arrange it”. In invoice fraud a real invoice arrives from a real supplier, but with a new account number — sometimes because the supplier’s mailbox was hacked.
The scammers have done their homework: names from LinkedIn, the site’s house style, sometimes a hijacked e-mail account. So “it looks real” does not work as a check. What does work: one fixed rule for every payment that deviates.
How to spot it
- 1Urgency and secrecy.“Today”, “do not discuss this with anyone”, “I am unreachable”. Real urgent payments are rare and never secret.
- 2A slightly different sender address.director@company-nl.com instead of @company.nl. On a phone you only see the name.
- 3A new account number.“Our bank details have changed” by e-mail, without a phone call. That is the entire invoice fraud in one sentence.
- 4A foreign IBAN for a Dutch party.Or an IBAN in the name of a private person.
- 5Behaviour that does not fit.A director who never asks for payments himself, or a supplier who suddenly writes “urgent”.
A real example, taken apart
- Confidential + urgent + unreachable: the script.
- A real acquisition runs through the notary with documents, not through an e-mail to the admin.
- The sender address was mark.devries@company-holding.com — the company mails from @company.nl.
What you do
- One rule: deviating payments are always confirmed by phone.Via the number you already had — not the number in the e-mail. With the director himself, with the supplier via the known number. No exceptions, not even for the boss.
- New bank details? Always call.Make it a fixed procedure: an account number change is processed only after a call to a known number.
- Four-eyes above a threshold.Two people approve every payment above an amount. Scammers aim at whoever sits alone.
- Already paid? Call the bank within the hour.Business transfers abroad can sometimes still be stopped. File a police report, report to the Fraudehelpdesk, and inform the supplier if their mail was hijacked.
Never do this
- Make a payment because the e-mail is “from the director” and urgent.
- Change an account number on the basis of an e-mail alone.
- Keep it “discreet”. Discretion is the scammer’s weapon.
Questions people ask
We are a small business. Are we a target too?
Especially. Small businesses rarely have a four-eyes rule, and the names are on the site and the Chamber of Commerce. One agreement (call on deviations) protects you almost entirely.
The e-mail really came from our supplier’s address. How is that possible?
Then the supplier’s mailbox was hacked. The scammer reads along, waits for a real invoice and resends it with a different account number. Hence: call on every change.
Is the bank liable if we transfer to the wrong number?
Usually not: you approved the payment. Calling fast may help freeze the money; after that it is a police matter.
Paste it into the checker. Thirty seconds, and you know what others already saw.