Anatomy of an Executive Impersonation Scam

An executive’s name, photo, job title, and public profile can give an attacker everything they need to manufacture trust.

Executive impersonation attacks exploit something traditional security controls cannot easily patch: people’s willingness to trust a familiar person or recognizable name. Falling for these impersonations can be extremely costly. The Federal Trade Commission reported that people lost $3.5 billion to imposter scams in 2025. While the figure covers imposter scams broadly, it illustrates the enormous financial impact that can result when attackers successfully manufacture trust.

A scammer can copy an executive’s identity, create a convincing social media profile, spoof an email address, or even use AI-generated audio and video to make a fraudulent request appear to come directly from the person being impersonated. 

In one real-world example, a finance employee at a multinational firm in Hong Kong joined a video call with what he thought was the company’s UK-based CFO. He saw a familiar face, heard a familiar voice, and recognized other colleagues on the call. After the pre-recorded conference ended, the attackers continued issuing instructions over instant messaging. Over the following week, the employee made 15 transfers totaling around the equivalent of $25.6M USD to five local accounts.

That attack happened in 2024, and since then, the technology available to attackers has continued to evolve, giving attackers additional ways to create convincing impersonations across more channels. The technology may change, but the underlying attack doesn't.

The executive impersonation process: How and why it works

A successful executive impersonation attack usually isn't improvised. Attackers can spend time researching their target, collecting information, and choosing the right moment and communication channel before they ever contact a victim.

The case illustrates a six-stage executive impersonation process: An attacker wants to impersonate a company's CFO and convince an employee to make a payment.

Step 1. They choose an impersonation target

Executives are attractive targets because their identities carry authority inside and outside an organization. A request that might look suspicious coming from a stranger can seem routine when it appears to come from the CEO, CFO, or another trusted senior leader.

The role matters, too. An attacker impersonating a CFO can make a plausible request about a payment or financial transaction. An attacker impersonating an HR leader might ask for employee information. Someone impersonating a CEO might invoke a confidential acquisition, strategic initiative, or urgent business matter.

And attackers don't need access to an executive's actual accounts to create a convincing impersonation. They can build it using information that's already available online.

Step 2. They gather intelligence

Public sources can reveal an extraordinary amount about an executive and the organization around them.

LinkedIn profiles can provide job titles, reporting relationships, professional history, and connections. Company websites may reveal leadership teams, office locations, suppliers, and recent announcements. Social media can provide photographs, writing styles, travel schedules, interests, and other details that make an impersonation more convincing.

This information helps an attacker answer an important question: What would this person plausibly ask someone to do?

In our example, a CFO may regularly communicate about payments, vendors, acquisitions, investments, or other financial matters.

The attacker is also looking for the people around the executive. Who works in finance? Who reports to the CFO? Who handles payments? Who is likely to recognize the executive's name but may not communicate with them regularly?

That research gives attackers material for creating fake profiles, emails, messages, websites, and other pieces of the scam. It also helps them identify the person most likely to act on the eventual request.

Step 3. They create the impersonation

The attacker then builds a credible version of the executive's identity.

That could mean creating a fake LinkedIn profile using the executive's name and photograph. It could involve registering a lookalike domain and creating an email address that resembles the executive's legitimate address. Or it could mean impersonating the executive through a messaging platform such as WhatsApp or Telegram.

AI can make this step considerably more convincing. Attackers can generate polished messages, imitate writing styles, and create synthetic audio or video using material collected from legitimate public appearances.

But sophisticated technology isn't a requirement. A copied photograph, a familiar name, and a believable request can be enough.

Step 4. They establish credibility

Before making a request, an attacker may first establish a relationship with the target, send a seemingly ordinary message, or create a profile that looks legitimate enough to survive casual inspection. A fake executive profile might contain the person's real photograph, job history, company information, and even copied posts.

That familiarity lowers suspicion. The attacker can also exploit information gathered during reconnaissance to make the conversation feel timely and authentic. A reference to a real project, colleague, business trip, or company announcement can make a fraudulent interaction much harder to dismiss.

For example, in the deepfake case above, the victim wasn't simply sent an email demanding money. The attacker created the appearance of a confidential business meeting involving the CFO and other colleagues. The use of familiar people and a plausible business context made the fraudulent request feel like part of an ordinary work process. According to Hong Kong police, the video conference was actually pre-recorded using publicly available video clips and voices.

Step 5. They create urgency

Once the victim is engaged, the attacker introduces a reason to act quickly.

It might be a confidential acquisition that needs immediate payment, urgent language, claims of a “sensitive personal matter,” or a request to purchase a gift card out of the blue.

Urgency matters because it discourages the victim from stopping to verify the request through a separate channel.

It also reinforces the authority established earlier in the attack. If the person making the request appears to be a senior executive and says the matter is confidential and time-sensitive, questioning the request can feel like creating a problem rather than preventing one.

Step 6. They make the ask

The final step is whatever action generates value for the attacker. That could be:

• Transferring money to an attacker-controlled account.

• Sharing credentials or authentication codes.

• Sending confidential company information.

• Purchasing gift cards or cryptocurrency.

• Clicking a phishing link.

• Installing malicious software.

• Continuing the conversation through a private messaging platform.

• Providing personal information that can support another fraud attempt.

When conducted over email, executive impersonation can overlap with business email compromise (BEC), in which a criminal attempts to trick a senior executive or budget holder into transferring funds or revealing sensitive information, such as intellectual property.

The impersonation is the mechanism for making the request believable.

Why executive impersonation works

The success of an executive impersonation attack doesn't depend on creating a perfect fake. It just needs to create enough credibility to keep the victim moving.

Several psychological levers make that possible:

• Authority: People are more likely to act on a request when they believe it comes from someone with organizational authority. A CFO asking for a payment doesn't look like an unusual request. A stranger asking for the same payment does.

• Familiarity: A recognizable face, name, job title, or company can make an interaction feel legitimate before the victim has consciously evaluated it. Attackers don't necessarily need to impersonate someone the victim knows personally. They can exploit the credibility attached to a recognizable executive identity.

• Context: The more an attacker knows about the organization, the easier it is to make a request fit the victim's expectations. A reference to a real project or colleague can provide enough context to make the interaction feel authentic.

• Urgency: A time-sensitive request reduces the opportunity to stop, question the request, and verify it through another channel.

• Secrecy: Attackers may frame a request as confidential, which gives the victim another reason not to discuss it with colleagues who might otherwise recognize the fraud.

Together, these tactics create a dangerous shortcut: the victim is encouraged to validate the identity emotionally before validating it technically.

That is what makes executive impersonation so difficult. The attacker isn't necessarily trying to break through a security control. They're trying to convince someone to use a legitimate system, account, or business process on the attacker's behalf.

The deepfake in the case above made that deception more convincing, but it wasn't the core of the attack. The underlying playbook was familiar: establish trust, create context, introduce urgency, and make the request. The technology simply made the impersonation harder to question.

Common types of executive impersonation 

Executive impersonation is not one specific attack type. It’s a collection of tactics that use an executive’s identity to establish credibility.

Fake social media profiles

One of the simplest approaches is also easy to repeat: Create a fake account using the executive's name, photograph, employer, and professional information.

LinkedIn is an obvious target because professional profiles provide so much useful information, but attackers can use almost any social platform. That makes broad social media protection increasingly important. Organizations need to be able to identify and respond to VIP impersonations across the platforms where their employees, customers, partners, and prospects actually interact.

Fake profiles may be used to contact employees directly, approach customers or partners, promote fraudulent investments, or redirect victims to malicious websites. The account doesn't necessarily have to convince everyone, just the right person. 

Social media impersonation scams also don’t stop with executives. Netcraft researchers have observed fake social profiles using stolen names and photographs to impersonate financial experts and other trusted individuals. In one campaign, scammers used fake profiles to establish relationships with potential victims before moving conversations to WhatsApp and encouraging them to deposit money into fraudulent investment platforms.

But a fake identity doesn't always target the impersonated organization's employees. It can target customers, investors, partners, or members of the public. The executive's identity becomes a credibility asset that the attacker can deploy wherever trust has value.

Spoofed or lookalike email addresses

Attackers can create addresses that resemble legitimate corporate accounts or use domains that differ from the real domain by only a few characters.

The message itself may look completely ordinary. A short request from a senior executive can be more effective than an elaborate phishing email because the supposed sender provides much of the credibility.

And email impersonation doesn't necessarily require compromising the executive's account. A lookalike domain or spoofed address can create the appearance of a legitimate sender without ever touching the organization's actual email environment.

Messaging-app impersonation

WhatsApp, Telegram, and other messaging platforms can give attackers another route to their targets, particularly when employees already use those channels for business communication.

A fake executive may ask an employee to continue a conversation privately, then use that channel to make increasingly sensitive requests.

This also creates a visibility problem for organizations. A fraudulent conversation happening entirely in a private messaging app may never be visible to the security or fraud team until after the victim has acted.

Voice and video impersonation

Generative AI adds another layer to executive impersonation. Attackers can use publicly available recordings to create convincing synthetic voices or videos. That makes the old advice to “just call the executive” less definitive than it once was. Do not treat a familiar voice or live-looking video as proof of identity. Verify unusual requests through a separate channel using contact details you already trust.

The technology is different, but the underlying psychology is familiar: Make the victim believe they're interacting with someone they already trust.

Why executive impersonation is difficult to stop

The problem for security and brand protection teams is that executive impersonation typically takes place outside the organization's own infrastructure.

A legitimate executive's LinkedIn account may be secure while an attacker operates a fraudulent account somewhere else. The company's email security may be working exactly as intended while a scammer sends messages from a lookalike domain outside the company’s control. An organization's endpoints may be uncompromised while an employee is persuaded to authorize a fraudulent payment. There may be no compromised account to find. The attack can exist entirely in the external digital ecosystem, including social platforms, lookalike domains, messaging apps, fake websites, and other infrastructure the organization doesn't control.

Controls protecting corporate accounts and endpoints address only part of the risk. Executive impersonation may also use third-party platforms and lookalike infrastructure.

That changes what effective protection needs to look like. Securing the executive's legitimate accounts is only one part of the problem. Organizations also need visibility into how their executives' identities are being used across social networks, messaging services, and lookalike web infrastructure, so they can identify fraudulent profiles and infrastructure before those identities are used to target employees, customers, partners, or the public.

Netcraft's executive impersonation protection monitors major social platforms for fake profiles and uses multiple attributes, including images, profile engagement, and text descriptions, to identify potential impersonations. Once identified, fraudulent profiles and associated scam infrastructure can be disrupted and taken down.

An executive doesn't have to be compromised for their identity to be weaponized. That's what makes executive impersonation different from many traditional security threats, and why protecting the identity itself has to extend beyond the organization's perimeter.

Organizations can reduce executive impersonation risk by requiring employees to verify unusual payment or information requests through a separate channel using trusted contact details. High-value transactions and changes to payment instructions should require a second approver. Security and fraud teams should also give employees a clear way to report suspected impersonation, preserve the evidence, notify the relevant platform or provider, and monitor for related or recreated accounts. These controls apply whether the impersonation arrives through email, social media, a messaging app, or synthetic voice and video.