Klytic

Home›Guides›Email security

Email security · Understand

Impersonation and CEO fraud

CEO fraud targets a wire transfer or a change of bank details, not a computer. The message often has no attachment or link, and is sometimes technically flawless. A filter can spot a lookalike domain, a misleading display name or a known fraud scenario; the decision to pay, however, is verified through a channel the company already knows.

Updated October 20266 minOfficial sources cited

The scenario

The CNIL describes the fake transfer order, known as “CEO fraud,” in several stages. The fraudster researches the company: organization chart, customers, suppliers. They set up a fake domain name close to that of the company or a supplier, or impersonate an employee. Then they write, or call, posing as an executive or a supplier, with a request presented as urgent and approved at the top.

The variants are similar:

  • an unexpected, urgent and confidential transfer, requested by a fake executive or a fake group manager;
  • a supplier announcing a change of bank details for upcoming invoices;
  • a fake invoice, for the right amount and in the right format;
  • a fake inspection by a government agency, later used to write to the company’s customers with a new bank account, a scenario described by the French Ministry of the Economy.

The lever is always human: urgency, secrecy, authority. The French Ministry of the Economy advises not to act in haste, even when faced with an insistent caller, and to be extra vigilant during holidays, when accounting departments run with reduced staff.

An example, for illustration. Late on a Friday afternoon, an SME’s accountant receives a message from the “CEO”: a confidential acquisition, a lawyer who will call, a transfer to make before Monday. The message has no attachment and no link. Its display name is correct, its address is not. Nothing, technically, is “infected.”

Four forms of impersonation, not one

FormWhat it looks likeSPF, DKIM, DMARCWhat can detect it
Spoofed display name“Claire Martin, CEO” writing from a free email serviceValid for the sender’s real domain; DMARC does not deal with the display nameComparing the displayed name, the address and the names of the domain’s executives
Lookalike domainA doubled letter, a hyphen, a different extensionCan be perfect for the lookalike domainResemblance to your domain or a supplier’s, domain age, reputation
Your exact domain, sent from elsewhereThe displayed address is the real oneDMARC fails; it stops the message if the domain’s policy requires itDMARC check on arrival
Genuinely compromised accountThe message comes from the executive’s or supplier’s real mailboxEverything is validChange in behavior, content (new bank details), and above all the verification procedure

The DMARC specification says so itself: it deals neither with visually similar domains nor with display-name abuse. Three cases out of four therefore escape domain authentication. The details are in SPF, DKIM and DMARC, and the stolen-account case in spam, phishing, malware and compromised accounts.

What technology stops

  • Your exact domain being spoofed, when the domain publishes a DMARC quarantine or reject policy.
  • The lookalike domain, by comparison with your domain, your suppliers’ domains and well-known brands, and by domain age: a domain created last week that imitates yours is a strong signal.
  • The misleading display name, when the filter knows who the company’s executives are and compares the displayed name with the actual address.
  • Known scenarios: urgent transfer request, change of bank details, fake invoice, invitation to call back a number. A filter can recognize these patterns in the text, even without an attachment or link.
  • The anomaly: a regular supplier suddenly writing from another country, at another time, with a request it has never made before.

An often overlooked point: by default, a filter does not know who your executive is or who your suppliers are. Giving it that context, the names of executives and regular suppliers, is what allows it to see a fake executive.

What technology does not decide

A filter reduces the number of fake messages that get through. It does not approve a payment. A genuinely compromised account, a plausible request, a lookalike domain not yet on any list: a message can slip through. The last barrier is a procedure.

Reflexes to write into the procedure

  • Every change of bank details is confirmed through a channel already known: a call to the supplier’s number on file, never the one given in the message. The CNIL recommends contacting known contacts by phone or in person.
  • Dual approval above a threshold, by two people, one of whom is outside the email thread.
  • Urgency and secrecy are warning signs, not reasons to go faster. A real executive accepts a callback.
  • An up-to-date list of supplier and customer contacts, as the CNIL recommends, so you know whom to call.
  • Heightened vigilance during holidays, closing periods or organizational changes.
  • Registering domain names similar to yours, and two-factor authentication on email, two measures cited by the CNIL.

Who needs to know these rules

Not only the accounting department. Executive assistants, buyers, the people who manage supplier records and those who stand in for an absent colleague are natural targets of the scenario, because they have access to payments or bank details. The CNIL recommends training employees to check domain names and to be wary of unusual requests. A short written rule, known to all and regularly restated, is better than a verbal instruction: it allows an employee to say “no” to a fake executive without fear of being overruled.

If a fraudulent transfer has gone out: call the bank immediately to try to cancel it, keep the messages, and file a complaint with the police. Also warn the customers or suppliers whose name was used.

Frequently asked questions

Is DMARC enough against CEO fraud?

No. It stops exact spoofing of your domain, not the lookalike domain or the display name. See SPF, DKIM and DMARC.

Can a message with no attachment or link be dangerous?

Yes. Transfer fraud needs only a credible text and a person who carries it out.

The message comes from the supplier’s real address: is it safe?

Not necessarily: their account may have been stolen. See compromised account. A phone check settles it.

A fraud message was quarantined: should I release it to check?

No. Check with the known contact, without releasing it. See Quarantine, false positives and reporting.

Where Klytic stands

Klytic MTA splits this protection between its two plans. It works in front of any email service, without Klytic Mail.

ProtectionEssentialAdvanced
SPF, DKIM, DMARC checks, including for forwarded messagesYesYes
Brand impersonation, lookalike domains, display-name spoofingYesYes
Unusual sender behaviorYesYes
CEO fraudNoYes
Fake invoices, fake transfers, crypto, refunds, financing, phone callsNoYes
SMS alert when an important sender writesOptionOption

The domain fraud context (names of executives, regular suppliers) is set by the domain administrator: see Who sets the filter in Klytic MTA.

What Klytic MTA does not do: it does not approve any payment and does not replace your transfer procedure. It does not see a direct phone call, only messages that invite someone to call.

This page describes general measures. It replaces neither your bank’s advice nor that of the authorities in the event of actual fraud.

Sources

Consulted in October 2026.

  • CNIL, “Le faux ordre de virement international ou fraude au président” (Fake international transfer orders, or CEO fraud): how the attack unfolds (reconnaissance, similar domain, urgent request), prevention measures (calling back known contacts, approval procedures, registering similar domains, two-factor authentication). cnil.fr
  • French Ministry of the Economy, “Se prémunir contre l’escroquerie aux faux ordres de virement ou arnaque au président” (Protecting yourself against fake transfer order scams or CEO fraud): transfer presented as urgent and confidential, impersonation of a government agency to announce a change of bank details, not acting in haste, vigilance during holidays. economie.gouv.fr
  • RFC 7489, DMARC: outside the scope of the mechanism, visually similar domain names and display-name abuse. rfc-editor.org
  • Klytic, Klytic MTA page: how financial fraud protection is split between the Essential and Advanced plans, options, deployment modes, activation via the MX record. klytic.com

Reduce the risk of transfer fraud

The Klytic MTA Advanced plan adds detection of CEO fraud and fake invoices.

Talk to an advisor →

Compare Essential and Advanced

Further reading

Understand · Email securitySpam, phishing, malware and compromised accountsFour threats come through the same door and are not handled the same way. What gives each one away, what stops it, and why anti-spam alone is no longer enough.6 min readRead →Understand · Email securitySPF, DKIM and DMARC: what they protect, and what they do notSPF, DKIM and DMARC prevent others from using your exact domain. They do not read the message: what they stop, what gets through, how to deploy them.6 min readRead →Use · Email securityQuarantine, false positives and reportingWhat happens to a message held by Klytic MTA, how to release it, correct a false positive and report a malicious message.6 min readRead →

Welcome offer

30 days free trial, migration support included

No-commitment trial. An advisor calls you back to understand your needs and prepare your Klytic workspace.

🚀 Start the free trial See pricing