What is CEO Fraud and How To Recognise It

Someone Just Tried to Impersonate Our Director. Here's Exactly How I Caught It.

17 Apr, 26

An email landed in my inbox this week from “Jonathan Cundliffe” — our Managing Director.

It was polite. Appreciative. Marked Critical Update. And it was a complete fraud.

I caught it. But in a busy office, under deadline pressure, with 47 other unread emails waiting? Most people wouldn’t.

Here’s the anatomy of the scam and what to look for before it costs your business.

The Email That Almost Looked Real

A screenshot of a scam email impersonating a Director of the company.

From: Jonathan Cundliffe <[email protected]>

Subject: Critical Update – Requires Quick Response

“Good day Asma, I just wanted to take a moment to sincerely appreciate each and every one of your dedication… Kindly re-affirm your phone number for urgent matter. I’ll follow up shortly from my secondary line.”

Looks fine at a glance, right? Here’s why it isn’t.

🚩 The sender address is the first giveaway

The name says Jonathan Cundliffe. The actual address is a random Gmail account.

No director at any professional organisation sends company business from Gmail. This is called display name spoofing, scammers count on you reading the name and never checking the address. Always check the address.

🚩 Flattery is deliberate

That gushing first paragraph isn’t warmth, it’s a technique. Compliments trigger a subconscious desire to reciprocate. You feel appreciated, so you want to help quickly. That’s exactly what the scammer needs.

🚩 Phone number request is step one of two

This isn’t the actual scam, it’s the setup. Once they have your number, they move to WhatsApp or SMS, posing as the director stuck in a meeting, asking for a fast bank transfer or gift card “just this once.” It’s a two-stage trap, and stage one looks completely harmless.

🚩 The language feels slightly off

“Kindly re-affirm.” It’s polite, but is it Jonathan? Impersonators can mimic tone, but they can rarely replicate the specific way your boss actually writes. If the wording feels even slightly unfamiliar, that instinct is worth trusting.

What Is CEO Fraud?

CEO fraud is a type of cyber attack where a criminal impersonates a senior executive, a Managing Director, CEO, or CFO, to trick an employee into handing over money or sensitive information.

It doesn’t rely on viruses or malicious links. There’s nothing to click, nothing to scan. It’s pure manipulation. The attacker bets on one thing: that you trust your boss and won’t stop to question them.

The scam usually arrives as an urgent email. It might ask you to confirm your phone number, process a quick bank transfer, or share payroll details, always with a reason why it needs to happen now, and often with a reason why you shouldn’t mention it to anyone else.

It’s also far more common than most businesses realise. The FBI estimates that CEO fraud has cost businesses worldwide over £19 billion in losses. And unlike a data breach, there’s rarely a way to get the money back once it’s gone.

What I Did Next (And What You Should Do Too)

I didn’t reply and I didn’t click anything. I contacted Jonathan directly, by phone, not by email and confirmed in 30 seconds it was a scam.

That’s it. One extra step would have saved a potential bank transfer, a data breach, or worse.

At J700 Group, we call this out-of-band verification: when something feels urgent and involves money or personal data, you confirm it through a completely separate channel. Always.

The Honest Truth About Cyber Security

Your firewall won’t catch this. Your spam filter probably won’t either, this email made it straight to my inbox.

The only thing that caught it was training, habit, and a workplace culture where questioning a suspicious “director’s” email isn’t seen as being difficult, it’s seen as doing your job.

Has your team been trained to spot this specific type of attack?

We work with businesses across Lancashire and Manchester to build that culture, the tools, the training and the processes that catch scams before they land. If you want to know how protected your team actually is, call us on 0333 7721 700 or get in touch today.