An urgent request from the chief executive can put a finance employee in a difficult position. The message appears to come from the person who can authorise the payment. It stresses confidentiality, explains why the usual approver is unavailable and asks for immediate action. Following the request may feel like doing the job well.
In this hypothetical scenario, the security problem involves authority as much as email. Protecting a finance team requires a process that employees are allowed to follow when a request seems to come from the top. The CEO has a direct role in making that process credible before somebody needs to challenge an instruction.
Understand the business decision the attacker wants
CEO impersonation aims to borrow executive authority to influence an action. The request might involve a payment, a purchase, sensitive information or a change to normal procedure. The FBI’s guidance on business email compromise describes criminals posing as familiar sources and recommends independent verification of payment requests and changes to payment procedures.
The most useful internal discussion begins with the decision being requested. Who can create a new payee? Who can change bank details? Who can authorise an urgent transfer? Identify the evidence each decision requires and whether one person can perform several steps without an independent check.
Do this for executive requests as well as supplier correspondence. A procedure that applies only to unfamiliar senders leaves a gap precisely where employees may feel least comfortable asking questions. The rule should follow the sensitivity of the action, with the same verification requirement for whoever appears to request it.
Separate instruction, verification and approval
Define a trusted route for confirming important requests. Use contact details already held by the company and maintain a record of the confirmation. A reply to the same suspicious email does not provide an independent route, and a phone number supplied in that message should not become the verification reference.
The Take Five guidance on invoice and mandate fraud explains how criminals impersonate trusted organisations and provide changed bank details. A practical finance control is to treat a change of destination as a separate approval event, even where the invoice itself is expected.
Plan an exception route for urgent work. If the usual approver is unavailable, identify another authorised person and the checks they must complete. Documenting this in advance avoids an improvised decision about whether urgency justifies bypassing a control. Keep the number of exceptions visible so leadership can see where the normal workflow needs improvement.
Make challenge a supported part of the job
The CEO should tell staff that verification applies to their own requests and demonstrate that expectation in daily work. When a finance employee asks for confirmation, the response should reinforce the process. A policy loses credibility if senior people routinely express irritation when it delays them.
Give staff language they can use comfortably. They can explain that the company verifies all new payment instructions and that they will use the established approval route. This frames the conversation around a shared process and reduces the need for a junior colleague to make a personal accusation.
Practice situations that include pressure, absence and incomplete information. In a team exercise, a payment might be legitimate but missing approval, or an apparent executive request might be fraudulent. The goal is to follow the same reliable method in both cases. Evaluate the verification steps and escalation decisions, rather than whether the employee guessed the answer from the message’s appearance.
Support finance controls with inbox protection
Noon Security checks email for phishing, business email compromise and impersonation, including messages posing as executives or suppliers. It provides warnings and reporting buttons, with removal of confirmed threats across mailboxes. These capabilities can support finance staff at the point where a questionable instruction arrives. A useful rollout would include the mailboxes handling invoices, supplier changes and executive correspondence, together with a named person to review reports. The finance policy should specify what happens to the requested transaction while the message is assessed, so an alert leads to a clear operational decision.
Test the process while the money is still safe
Run a short tabletop exercise using a fictional request and no real transfer. Ask the team to locate the supplier record, identify the approver and demonstrate the independent verification route. Then make the usual approver unavailable and observe whether the fallback process is understood.
Check the response plan too. If a suspicious payment has already been made, who will contact the bank immediately? Who will preserve the message and transaction information? Who can secure any affected account and coordinate further reporting? These names and contact details should be available before an incident.
Close the exercise by fixing one specific weakness, such as an outdated supplier number or an unclear backup approver. The CEO’s most effective contribution is consistent support for those controls. Finance employees should know that protecting the company includes pausing a request, obtaining evidence and asking a senior colleague to follow the agreed process.
