Is This Request Really From the Boss?

“Are you at your desk? I need a quick favor, and keep this between us for now.” If a message like that ever lands in your inbox, the boss probably did not send it.

Business email compromise, or BEC, is one of the most financially damaging forms of cybercrime. The FBI’s 2025 Internet Crime Report logged 24,768 BEC complaints with more than $3 billion in reported losses in a single year. There is usually no malware and nothing to click. Just a believable request and a person trying to be helpful.

Anatomy of the scam

How CEO fraud works

Attackers research a company through its website, LinkedIn and press releases. They learn who the owner is, who handles payments and which vendors the company uses. Then they send a message that appears to come from the boss, in one of three ways:

• A lookalike domain: acme-c0rp.com instead of acme-corp.com, or an extra letter that is easy to miss on a phone screen.
• A free email account: A Gmail or Outlook address with the boss’s real name as the display name, which is often all a phone shows.
• The boss’s real account: The most dangerous version. The mailbox was taken over earlier, usually through a phishing email, and the attacker has been reading along quietly.

The request itself is usually one of a few classics: buy gift cards for a client, wire money for an urgent deal, change a vendor’s bank details, or send employee tax forms. The message always adds urgency and secrecy, because both discourage you from checking.

The scam does not beat your technology. It borrows your boss’s authority.

Red flags to watch for

• Unusual payment method: Gift cards and cryptocurrency are almost never legitimate business payments.
• Secrecy: “Don’t mention this to anyone” is a manipulation tactic, not a business process.
• Changed bank details: New account numbers for an existing vendor deserve a phone call every time.
• Odd timing or tone: Requests sent while the boss is traveling, on vacation or in a meeting are common.
• Reply-to mismatch: The reply address differs from the sender’s normal address.
• Pressure to skip the process: Any request to bypass normal approvals “just this once” is the scam telling on itself.

A realistic scenario

The Friday afternoon wire

Picture a bookkeeper at a 20-person construction company. At 3:40 on a Friday an email arrives from the owner, who everyone knows is out at a job site: a supplier needs a deposit today to lock in a materials price, here are the wiring instructions, don’t bother calling, I’m tied up. The sender domain is one letter off. The tone sounds exactly right, because the attacker spent weeks reading real email threads after breaking into a vendor’s mailbox.

If the bookkeeper sends the wire, the money is typically moved through several accounts within hours. If she picks up the phone and calls the owner’s cell, using the number already saved in her contacts, not one from the email, the scam dies in two minutes.

The rule that stops it

Always verify payment and data requests through a second channel. Call the requester on a phone number you already have, or walk to their office. Never use contact details from the suspicious message itself.

• Call back every change: Any new payee or change in bank details requires a call to a known number, and a note of who confirmed it.
• Two people for big payments: Require a second approver above a set dollar amount.
• No gift cards by email, ever: Make it a standing policy so no one has to judge each request.
• Treat data like money: Payroll changes and requests for W-2s or employee records get the same verification as a wire.

Technical controls that help

• MFA on every mailbox: It blocks most account takeovers, which are the hardest version of this scam to spot.
• External email banner: Tag mail from outside the company so a fake “boss” message stands out.
• SPF, DKIM and DMARC: Set these up on your domain so criminals cannot send email that looks like it came from you.
• Alerts on forwarding rules: In Microsoft 365 or Google Workspace, a new rule forwarding mail outside the company is a classic sign of a compromised account.

If money already went out

Speed matters more than anything. Call your bank immediately and ask it to recall the wire, then file a complaint at ic3.gov. The FBI works with banks to try to freeze fraudulent transfers, and the odds are best in the first day or two.

Put the verification rule in writing and make it clear that no one will ever get in trouble for double-checking. Owners should say it out loud: “If I ever ask you for gift cards or an urgent wire by email, assume it is not me.” Most of these scams start with a phishing email, so pair this with how to spot a phishing email in under 30 seconds, and read the #1 thing you can do to survive ransomware for the other half of email-driven risk. A two-minute phone call is the cheapest fraud prevention you will ever implement.