VETERAN-OWNED · NEBRASKA-BASED
An email lands at 4:40 on a Friday. It shows the owner's name, and it asks the office manager to send a wire before the bank closes. That is CEO fraud, a form of business email compromise that reaches small offices in Lincoln, Omaha, and across Nebraska.
Our business email compromise guide maps the whole family of these scams. Our post on vendor payment-change fraud covers the accounts payable side.
This post stays with one question. What should your team do when someone who sounds like the boss asks for money?
What a CEO fraud email looks like
The message usually appears to come from the owner, a partner, or a senior manager.
The ask is short. Send a wire to a new account. Buy gift cards and text me the codes. Update my direct deposit before Friday's payroll.
The tone leans on trust and pressure. "I'm boarding a flight." "I'm in a meeting and can't talk." "Keep this between us until this closes."
The sender line often shows the right name with the wrong address underneath. It might be a personal email account, or a domain that is one letter off from yours. Phone mail apps often show only the name, so the address never gets a look.
Sometimes the reply-to address differs from the sender. Your team hits reply, and the answer goes straight to the attacker.
The hardest version comes from the executive's own mailbox. If that account was phished earlier, the email arrives from the right address, inside a thread your team already trusts. Our post on the mailbox rule finance never sees shows how an attacker can sit quietly in a mailbox while they learn who approves payments.
Why these emails work
They borrow authority. Few people in a small office want to slow down the owner, and the email is written to make a question feel like a problem.
They pick the timing. Requests tend to show up late in the day, before a holiday, or while the executive is known to be traveling. Those are the hours when a call back feels hardest.
They ask for secrecy. A note that says "don't mention this to anyone" cuts off the one step that would catch it.
They often avoid wires. Gift cards and payroll changes feel smaller, so they get less scrutiny, and that money is just as hard to recover.
The call-back rule
Any request from an executive to move money, buy gift cards, or change payroll gets a phone call before anyone acts.
The call goes to a number you already had: the one saved in your phone, the company directory, or the employee file. Never use a number from the email, the signature, or a text that came with it.
Ask the person to confirm the request in their own words. Don't read them the details and ask for a yes.
If you can't reach them, the request waits until you can.
Put the rule in writing and have the owner sign it. Staff are far more willing to call back when the owner has already said, on paper, that they want the call every time.
Then make sure the owner means it. The first verification call should be met with thanks.
Dual approval for wires and payroll changes
Dual approval covers the days when the person who got the email is rushed, new, or covering for someone else.
- One person sets up a wire, and a second person approves it before it is released.
- A new payee or a changed bank account needs both the call-back and a second approver. A phone call alone does not approve a new payee.
- A direct deposit change is confirmed with the employee by phone or in person, using contact details already on file.
- Gift card purchases for the company go through the same approval as any other payment.
- Nobody skips the rule because the request came from the top. The rule exists for exactly those requests.
Ask your bank whether your business account can require two people to release a wire, and turn it on if it can. Check whether your payroll service can alert you or require approval when someone changes bank details.
MFA and mailbox checks for executives
Executive mailboxes are worth a lot to an attacker, so they deserve the tightest settings.
- Turn on MFA for every mailbox in Microsoft 365 or Google Workspace, starting with owners, partners, and anyone who approves payments.
- Review inbox rules and forwarding on executive and finance mailboxes on a schedule. A rule that hides replies or sends mail outside the company is a strong sign of compromise.
- Block or alert on automatic forwarding to outside addresses.
- Turn on external sender tags where your platform supports them, so a personal email account using the owner's name stands out.
- Set up SPF, DKIM, and DMARC on your domain to make spoofing your own address harder.
For how we handle this for clients, see email security. Lincoln businesses can also read about cybersecurity services in Lincoln.
The first hour if money already moved
Call your bank's fraud line right away. Tell them the transfer was sent because of an impersonation email and ask them to try a recall. Speed matters more than having every detail ready.
Preserve the email. Keep the message, its full headers, and any replies. Leave any strange inbox rules in place too, because the bank, your insurer, or law enforcement may need them.
File a report with the FBI's Internet Crime Complaint Center at ic3.gov. Include the transaction details your bank gave you.
Reset the password and sign-in sessions on any mailbox that may be involved, and check it for new rules or forwarding. If you have cyber insurance, call your carrier, since they will have their own reporting steps.
Our business email compromise first actions guide walks through the rest.
Lincoln, Omaha, and the rest of Nebraska
SAINT works with offices in Lincoln and Omaha, and with businesses across Nebraska, on the email, identity, and payment controls in this post. More on how we work is on our cybersecurity page.
Here's a question for this week. If an email from the owner asked for a wire at 4:40 on a Friday, who in your office would pick up the phone first?