Executive phishing scams: how the fake boss email works
Quick answer
An urgent email or text that seems to come from your boss or an executive and asks you to wire money, buy gift cards or change payment details is a scam. Don't act on it. Check with the person using contact details you look up yourself, then report it at ic3.gov and ReportFraud.ftc.gov.
- First reported
- Latest official alert
- (FBI IC3)
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
How it works
This is a form of business email compromise (BEC), which the FBI's Internet Crime Complaint Center (IC3) describes as a scam that targets both businesses and individuals who make legitimate transfers of funds. Between October 2013 and December 2023, IC3 counted 305,033 incidents with total exposed losses of more than $55 billion, reported in all 50 states and 186 countries.
Scammers either take over a real email account or make a message look like it came from someone you trust: a boss, a company owner, a vendor or a colleague. Then they ask for money or details:
- A payment request: an urgent wire transfer, a changed bank account for an invoice, or gift cards "for a client".
- A request for personal information: employee records or login details.
- A pressure line: the sender says they're in a meeting, can't take a call and needs it done now.
The FTC also warns that new employees are an easy target, because they're keen to please and less likely to question a message from the "boss". The money often moves to payment processors, peer-to-peer payment apps or cryptocurrency exchanges, which makes it hard to pull back.
Sources checked: ic3.gov, consumer.ftc.gov, ftc.gov
Last verified against the official page:
Red flags
- An urgent request for money or gift cards from a boss or executive, often sent from a phone or a personal address
- A sender who says they can't talk and wants it kept quiet
- A change to the bank details on an invoice you were about to pay
- A sender address or domain that is slightly misspelled
- A request to send login details or personal information by email
- Pressure to act fast and skip your normal approval steps
Example message
Hi, it's [name]. I'm in a meeting and can't talk. I need you to handle something for a client today. Can you buy [number] gift cards and send me the codes? I'll pay you back this afternoon. Reply here, don't call.
What to do
- 1
Don't reply or pay
Don't answer the message, click links or open attachments. The FBI advises verifying any request to move money or change account details through a second channel.
- 2
Check with the real person
Call or message your boss or vendor using contact details you already have or look up yourself, not the ones in the message. Tell your manager or IT team too.
- 3
If you sent money, call your bank right away
IC3 says to contact your financial institution at once and ask for a recall of the funds. Speed matters, so don't wait to file a report first.
- 4
If you shared logins or personal details, secure your accounts
Change the passwords you shared, use a different password on every account and turn on multi-factor authentication. If personal information was involved, IdentityTheft.gov lists the steps for what was exposed.
- 5
Report it
File a complaint at ic3.gov whatever the amount, and report it to the FTC at ReportFraud.ftc.gov. You can also report phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org.
Report it
Check if your details are exposed with Serus
Scammers find your number and address on data brokers and people-search sites. Serus removes them.
Why you got it
Scammers pick a target they can tie to a boss or employer. Names, job titles, work emails and phone numbers are easy to find on people-search sites and professional profiles, and they turn up in data breaches. Serus finds where your contact details are listed and removes them, and alerts you when your details show up in a breach, so fewer scammers can build a convincing message to you.
Official alerts
Frequently asked
Is an email from my boss asking for gift cards real?
Treat it as a scam until you've checked. The FTC says anyone who tells you to buy gift cards or move money to fix a problem is almost certainly a scammer. Confirm with your boss using contact details you look up yourself.
What is business email compromise?
The FBI defines it as a scam that targets businesses and individuals who make legitimate fund transfers. Criminals take over or fake a trusted email account to trigger an unauthorized transfer.
I already sent the money. What now?
Contact your bank immediately and ask it to recall the funds, then file a complaint at ic3.gov. IC3 says to report regardless of the amount.
How can I check the sender is real?
Look at the full sender address and the domain for misspellings, and verify the request through a second channel such as a call to a number you already have.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
