CEO Fraud

EN
Spanish language. Press to change

Spanish language. Press to change
Close
- Spanish
- Català
- Euskera
- Galego
- Valencià
- Deutsch
- English
- Français

CaixaBank (Go to home)

An urgent request that seems real... but isn’t

Cybercriminals have refined their methods to attack companies from the inside. With a well-planned strategy, they impersonate senior executives—such as the CEO—to deceive employees who have access to sensitive information or authority to approve payments.

This type of scam, based on social engineering techniques, requires attention to detail and a critical attitude. We explain how they work and how to protect yourself.

How does the CEO scam work?

Observation and information gathering phase

The scammer researches the company in depth: structure, projects, accounting statements, workers, etc., often through public information available online.

Identity impersonation

Once the target is identified, the attacker either spoofs the CEO’s or senior executive’s email address or attempts to gain access to their actual account, so the message comes from an address that doesn’t raise suspicion.

Phone calls may also be used in some cases.

Direct contact with the victim

The fraudster contacts the person identified as having access to the company’s finances with a message that combines:

Urgency: "This payment must be made immediately."
Confidentiality: "Don't tell anyone, this is a sensitive issue."
Incentive: "This gesture will not go unnoticed."

It’s common for a second, supposedly trusted person to be introduced to provide the payment instructions.

Execution of the scam

Convinced that the communications are genuine, the employee follows all instructions and makes the payment to accounts controlled by the fraudster.

How to prevent this scam?

Be suspicious of anything unusual

If you receive an unexpected or urgent request, verify it through a different channel. Contact the relevant executive directly, or if that’s not possible, use their usual phone number or email address.

Don’t give in to pressure

Don't ignore your critical thinking just because the sender is a senior executive. Follow the established procedures.

Mind what you share on social media

Avoid posting details about your role or internal processes. Any data could be useful to scammers.

If the scam has already been carried out, don’t delete the evidence

Keep hold of emails, phone records, or any documentation provided by the fraudsters. Contact your bank and report the incident immediately.

Do you think you may have been a victim of a scam?

Scams are often disguised as emergencies or threats. Be especially wary of any urgent requests for details or payments.

Keep calm, use your common sense, and if you think you might be a victim of fraud, get in touch with CaixaBank immediately through the official channels: Wall or by calling 938 87 25 25.

CEO fraud