8 CEO fraud examples: real cases, the emails behind them and how to stop them

In brief: CEO fraud, also called business email compromise (BEC), is an attacker impersonating a senior leader to get an employee to transfer money or data. It is the most expensive form of cybercrime by a wide margin: the FBI recorded around $2.8 billion in reported BEC losses in 2025 alone. The eight examples below are real, range from €37,000 to €70 million, and share one pattern: authority, urgency, secrecy, and an employee who did not pick up the phone. Each example shows the message that started it; the final section gives the five rules that would have stopped every one of them.

What CEO fraud looks like

The classic version is an email. “Are you at your desk? I need you to handle a confidential payment today.” It can also be a WhatsApp message, a phone call with a cloned voice, or a video call with a deepfake. The target is usually in finance, an executive assistant, or someone in HR or purchasing who can move money or data. For the definition and legal angle, see what is CEO fraud; for the email itself, example 5 in our phishing email examples.

The 8 CEO fraud examples

1. Pathé Netherlands (2018): €19 million for a “confidential acquisition”

What happened: the Dutch branch of cinema chain Pathé received emails that appeared to come from the French head office about a confidential takeover in Dubai. Over several weeks the managing director and the CFO approved transfers totalling about €19.2 million. Both were dismissed; the court later ruled the dismissal of the CFO lawful.

The message: “This is strictly confidential. Do not discuss it with anyone in the organization. The first instalment must be transferred today.”

Why it worked: the secrecy clause removed every colleague who would have asked a question, and the deal sounded like something a head office would do.

2. FACC (2016): €52 million and the CEO fired

What happened: Austrian aerospace supplier FACC, which makes parts for Airbus and Boeing, transferred about €52.8 million after emails impersonating the CEO about an acquisition project. The company recovered a fraction, the CEO and the CFO were fired, and the case became the European reference for board-level consequences.

The message: an email chain from a lookalike address of the CEO, instructing the finance department to execute payments for a secret project.

Why it worked: a chain of plausible emails over time, not a single request, and no callback rule.

3. Crelan (2016): €70 million at a Belgian bank

What happened: Belgian bank Crelan lost around €70 million to CEO fraud, discovered during an internal audit. The attack targeted employees authorised to make transfers.

The message: instructions attributed to senior management to move funds, with the usual confidentiality framing.

Why it worked: even a bank, with controls built for external fraud, did not have a verification step for instructions that appeared to come from inside.

4. Ubiquiti Networks (2015): $46.7 million via a subsidiary

What happened: the US network equipment maker disclosed that employees of a subsidiary in Hong Kong were tricked into transferring $46.7 million to overseas accounts after emails impersonating executives and lawyers. Around $8 million was recovered.

The message: requests from “outside legal counsel” and “the executive team” for urgent wire transfers related to a deal.

Why it worked: the attackers targeted a subsidiary where staff did not know the executives personally.

5. Toyota Boshoku (2019): $37 million in one transfer

What happened: the European subsidiary of Toyota’s seat and interior supplier transferred about ¥4 billion ($37 million) after a third party posing as a business partner changed payment details.

The message: a convincing request to pay to a new bank account, inside an existing supplier relationship.

Why it worked: the variant where the “boss” is replaced by a trusted supplier: the same technique, a different sender.

6. Arup (2024): the $25 million deepfake video call

What happened: a finance employee at the Hong Kong office of engineering firm Arup joined a video call with the “CFO” and several “colleagues”, all AI-generated, and made 15 transfers totalling HK$200 million (about $25.6 million).

The message: an email about a confidential transaction, followed by an invitation to a video call that removed the employee’s doubts.

Why it worked: a face and a voice were treated as proof. See deepfake awareness training for the verification protocol that stops this.

7. Ferrari and WPP (2024): the attempts that failed

What happened: at Ferrari, an executive received WhatsApp messages and a call with the cloned voice of CEO Benedetto Vigna about a confidential acquisition; he asked a question only the real CEO could answer, and the caller hung up. At advertising group WPP, attackers set up a Teams meeting with a cloned voice and public images of CEO Mark Read; the target grew suspicious and reported it.

Why they failed: one employee verified, one employee reported. That is the entire difference between example 6 and example 7.

8. The SME case: €37,000 for gift cards

What happened: the version most companies actually experience. An office manager at a 60-person company received a WhatsApp message from the “CEO”: in a meeting, needs gift cards for a client, send the codes, keep it quiet. She bought €37,000 in gift cards over two days before a colleague asked why. This composite case is drawn from police and insurer reports; the numbers vary, the script never does.

The message: “Are you free? I need a quick favour and I’m stuck in meetings all afternoon.”

Why it worked: a small, plausible request from someone you want to help, with a reason not to call back.

The examples at a glance

The pattern in every case

1. Authority: the request comes from someone you do not question.
2. Urgency: today, before the deadline, before the deal closes.
3. Secrecy: confidential, do not discuss, keep it between us.
4. A reason not to call: in meetings, travelling, abroad, on a bad line.
5. A new destination for the money: a new account, a new country, gift cards.

Two of these five in one message is a signal. Three is CEO fraud until proven otherwise.

Five rules that would have stopped all eight

1. Every payment instruction is verified by phone on a number already in the directory, never on a number in the message. No exceptions for executives; executives endorse the rule publicly.
2. Four eyes on every transfer above a threshold and on every bank-detail change. One person cannot execute; a second approver asks the question the first did not.
3. A code word for urgent requests between leadership, finance and assistants, never written in email or chat.
4. Secrecy is a stop sign. “Do not tell anyone” means tell your manager and finance immediately.
5. Train and test the people who can move money. Finance, assistants, HR and purchasing get a targeted phishing simulation of exactly this scenario every four to six weeks, and three minutes of security awareness training a week. Ferrari and WPP were saved by trained people, not by technology.

What to do if it has already happened

• Within the hour: call your bank’s fraud desk to attempt a recall; the chance of recovery drops sharply after 24 hours.
• Same day: report to the police and, where personal data is involved, assess the GDPR notification duty.
• Same week: preserve the emails and headers, inform your insurer, and brief the whole company without blaming the employee. The next attempt is usually already in someone’s inbox.

Frequently asked questions

What is an example of CEO fraud?

An email or message that appears to come from the CEO asking an employee to make an urgent, confidential payment or buy gift cards. The Pathé case (€19 million) and the gift-card version (a few thousand euros) are the two ends of the same scam.

How common is CEO fraud?

Business email compromise was the most costly category in the FBI’s internet crime report for the fifth consecutive year in 2025, with around $2.8 billion in reported losses in the United States alone. Most cases are never reported publicly.

Can CEO fraud happen by phone or video?

Yes. Cloned voices and deepfake video calls (Arup, Ferrari, WPP) are the 2024 versions. The verification rule is the same: call back on a known number.

Who is liable when CEO fraud succeeds?

The company bears the loss, and directors can face consequences: at FACC and Pathé, executives were dismissed. Under NIS2, management is explicitly responsible for cybersecurity measures including training.