Fake president fraud – the damage is increasing

The “Fake President” scam is developing into a growing threat to German companies.

Experts attribute this to the use of Artificial intelligence back, which makes the fraudsters act ever more professionally.

What is behind the fake president fraud?

In this scam, also known as CEO fraud or business email compromise, criminals impersonate CEOs or board members. Their goal: to trick employees in the accounting or finance department into making unauthorized transfers.

The perpetrators send emails that supposedly come from the boss and concern urgent, highly confidential transactions – often foreign transfers for secret company acquisitions or important business deals.

Time pressure and the perceived authority of the senders are intended to prevent employees from questioning the instruction or adhering to usual control mechanisms.

A perfidious approach employing psychological calculation

The fraudsters work systematically: First, they gather information about the company, its structures, and the people involved.

This research is conducted using publicly accessible sources, social media profiles, or targeted pre-attacks. With this knowledge, they create deceptively authentic-looking emails.

The email is often followed by a phone call in fluent German, emphasizing the urgency and demanding absolute confidentiality. The target accounts are usually located in Asian countries or Eastern Europe, making tracing difficult.

Millions in damages despite fewer cases

The average damage per case now reaches the single-digit millions. This demonstrates the increasing sophistication of the perpetrators.

Because artificial intelligence enables them to more accurately mimic the speech patterns and writing styles of executives.

In addition to the classic fake president fraud, variants such as payment diversion are emerging: Payments to suppliers are redirected to fraudsters' accounts using fake contact details.

Effective protective measures for companies

Organizations can protect themselves against these attacks with clear guidelines.

◉ Introduce mandatory verification: Any unusual payment instruction must be confirmed by telephone with the alleged sender – important: use a separate telephone line, do not call back the number given in the suspicious email.

◉ Establish the four-eyes principle: Especially with large sums or international transfers, at least two people should be required to approve each transaction.

◉ Raise employee awareness: Regular training on social engineering and email security raises awareness. Employees should know that there are no consequences for questioning suspicious requests – even if they appear to come from the boss.

Developments show that technical security measures alone are not enough. The human factor and a corporate culture that encourages critical questioning remain crucial.

Sierks Media / © Photo: Charles de Luvio, Unsplash