Executive impersonation fraud is one form of payment-diversion scam: an attacker pressures a team to make an unusual payment while pretending to be a leader. Business email compromise (BEC) is broader and also includes supplier impersonation and fraudulent use of a business mailbox. The terms overlap but are not interchangeable. Independent verification and two-person approval can stop a payment scam before funds are sent.
How do executive impersonation and BEC differ?
BEC describes fraud that exploits business email or impersonates a trusted contact. Executive impersonation is one scenario; supplier payment fraud and misuse of a compromised business mailbox are others. The message may ask for a wire transfer, a bank-detail change, a document, or temporary access.
The attack works because the request feels plausible and urgent. The attacker does not necessarily need to decrypt a vault or guess a password: the goal is to influence the person who can authorize the action. Depending on the scenario, they may spoof an address or exploit a genuinely compromised mailbox.
Three common scenarios
- The executive who is “travelling.” Finance receives a request to complete a confidential transaction quickly, with a warning not to call.
- The supplier whose bank details changed. A real invoice is copied into a credible conversation, then the account details are replaced.
- The lookalike account or domain. A compromised mailbox or near-identical address makes the exchange appear routine.
These scenarios can be combined. In a targeted attack, earlier exchanges may help the fraudster learn the organisation’s roles and habits before sending a financial request that appears consistent with them.
Why passwords are not enough
A strong password protects an account. It cannot, by itself, determine whether a payment request is legitimate. The risk then moves to email, leadership accounts, accounting tools, and secrets shared across several people.
Critical access therefore needs several barriers:
- Distinct passwords. Finance or administration accounts should not reuse passwords from other services. Distinct passwords limit risks caused by reuse, but do not prevent phishing or impersonation. Use a secure password generator and keep secrets in a controlled vault.
- Out-of-band verification. For a new bank account, unusual payment, or urgent request, call a number already on file or use a separate internal channel.
- Separation of duties. The person receiving the request should not be the only person approving and executing the payment.
- Limited access. Finance, procurement, HR, and leadership accounts should have only the permissions they need, with regular access reviews.
This is the same principle behind secure team password sharing: sharing a secret does not mean copying it into email, a spreadsheet, or an untraceable chat. A password policy for small businesses also helps protect email accounts that can become an entry point for fraud.
Verify a request before paying
Before approving a sensitive request, ask four questions:
- Who is asking? The displayed address and familiar tone do not authenticate a person.
- What changed? A new bank account, beneficiary, account, or document deserves verification.
- What is the second channel? Confirm through contact details already on file, never through the message itself.
- Who checks it? A second person reviews and approves the operation according to the procedure.
For finance and procurement, keep evidence of that verification. For HR, apply the same caution to requests for documents or personal data. For leadership, make it explicit that urgency never justifies bypassing the control.
If a fraudulent transfer was made
If a transfer was sent, contact the bank immediately to request a recall; if it is still pending, ask the accounting team to suspend it. Alert the responsible people, preserve the messages, and review forwarding rules or active sessions on the affected mailbox. Do not delete material that may help the investigation.
If a mailbox was compromised, change its password, enable multi-factor authentication if available, and review its forwarding rules. Also replace passwords that were reused on other services. Finally, turn the incident into an operational rule: which requests trigger a call, who approves, and where is the evidence kept?
How Soclyde fits
Soclyde can help a team store and share unique credentials for finance, procurement, and email accounts, but it does not verify payment requests or stop payment fraud. Pair financial controls with the guide to secure team password sharing and the password generator.
Takeaway
The sender shown in an email is not proof of identity. For any bank-detail change or unusual payment, pause, call a number already on file, and require independent approval. Cybermalveillance.gouv.fr’s FOVI guidance also explains what to do if the transfer has already been made.
