When Marion is not Marion

CEO Fraud is a type of cybercrime in which the attacker impersonates the CEO to trick an employee into revealing sensitive data or transferring money. It is very common, both because it’s easy to do and it works more often than it should.

Know the Red Flags

There are five red flags in the email below. Can you spot them?

The red flags, from least to most critical:

1. The attacker plays on Kat’s desire to please the boss by saying, “Counting on you.” The attacker may or may not know this about Kat, but most employees want to please the boss. Don’t be surprised
2. The attacker uses a tone of authority by saying, “Please pay immediately.” This is why the fraudster is impersonating the CEO – Kat is unlikely to feel the need to get approval from someone else when she already has the approval of the CEO.
3. The attacker creates a sense of urgency, both in the subject line and the body. Payment is past due and the client is not happy. Panicked people make poor decisions.
4. The attacker provides cover for the bank account by saying the client has a new account number. He is subtly saying it’s okay if you notice we’re not using the existing account number in the system. Alternatively, there could be some wire instructions here, but either way it should be seen as a red flag because most people know not to share sensitive financial information in an email.
5. The attacker spoofs the CEO’s name in the header, but uses a different email address. In this case, the domain name is one letter off from the real domain. This is a surefire way to know it’s CEO fraud, but people don’t often check the email header to see the actual sender address. Mobile email apps including the Gmail app don’t normally show the sender address to conserve display space. You can get there with a tap or two, but most people don’t do that.

Simplifya Samples

Here’s one that Brooke received. She’s in a browser on her computer (rather than the mobile app) so it’s pretty easy to see the sender address is incorrect. Plus, Gmail did a good job of flagging the email as suspicious. But if the big red box wasn’t there and she was looking at this on her phone, she might have replied, and that’s all the attacker wanted (to know there’s an accommodating person behind brooke@simplifya.com). The next email might go to Kyle with something like, “Hey, I was just chatting with Brooke and we’d like to sponsor the Pacific Cannabis Coalition to do some networking out there. Please send $1500 to [account info] ASAP, thanks.” I’m not saying Kyle would fall for it, but you know, maybe!

Here’s a similar one that went to Mark. Note the attacker is fully prepared to exchange several emails before getting to the actual attack. And again, the obvious flag is the sender address.

The attacks are not limited to email. Here’s a text message that was sent to Tyler. The attacker is betting that Tyler wouldn’t recognize the number as not Marion (he lost the bet).

Final Thoughts

I hate to be the scary security dude, but CEO Fraud only works when the attacker finds an unsuspecting employee. Gmail does a pretty good job of identifying potential threats and providing warnings, I’m taking the time to explain CEO Fraud, and Marion has promised to never ask you for sensitive financial information. 😉 But it’s still likely to happen to you, if not yet, then eventually.

At the end of the day, it’s on you to recognize when it’s happening. Watch for the red flags described in this article. If you’re not sure, hit me up via Slack or text. In fact, even if you are sure, let me know so we can talk about it and warn others of the attempt.

And if you had a momentary lapse – I was on my phone, it looked like Marion, I realized as soon as I replied, etc. – please let me know. It happens, and we can probably work through it, but only if you say something. Thank you.

PS on February 13, 2023 – Kyle was on PTO when I wrote this post last week, but mentioned he recently got one of these emails. In this case, the attacker did some homework to identify Justin as one of our employees and make an educated guess that Kyle handles direct deposit changes. He’s obviously not the CEO, but as the only employee with a finance-related title, Kyle gets phished regularly!

I purposely asked Kyle to get me a screenshot from his phone so you can see how legit some of these attacks appear. On a computer, the message is displayed in a wider format that allows you to more readily see the sender’s email address and it was not Justin’s. Kudos to Kyle for staying alert!