EXECUTIVE IMPERSONATION: VERIFY UNUSUAL PAYMENT REQUESTS
Attackers may pretend to be an owner, director, manager or other senior person and request a payment or sensitive business action.
The request may arrive through email, messaging applications, social media, phone calls or another channel.
The central principle is:
AUTHORITY SHOULD NOT REMOVE THE NEED FOR VERIFICATION.
1. WHY EXECUTIVE IMPERSONATION WORKS
Employees may feel pressure to act quickly when they believe a request comes from senior management.
Attackers exploit that expectation.
They may use:
- Familiar names
- Executive job titles
- Copied signatures
- Compromised accounts
- New phone numbers
- Urgent explanations
- Requests for secrecy
2. TREAT UNUSUAL REQUESTS DIFFERENTLY
A request that differs from the person's normal behaviour deserves additional verification.
Examples include:
- A sudden request for a large transfer
- A request to use a new beneficiary
- A request to bypass another approver
- A request to purchase unusual items
- A request for sensitive credentials
- A request to keep the action secret
3. VERIFY THROUGH A KNOWN CHANNEL
Do not verify an unusual request only by replying to the same message or calling the number supplied in it.
Use a previously established contact method or the organization's trusted verification procedure.
4. NEVER SHARE AUTHENTICATION SECRETS TO PROVE IDENTITY
A genuine executive or authorized employee should not need another employee's password, OTP, recovery code or similar authentication secret simply to prove that they are who they claim to be.
Authentication secrets should remain protected.
5. BUSINESS EXAMPLE
An employee receives a message appearing to come from a director requesting an urgent payment and instructing the employee not to call because the director is in a meeting.
The employee follows the company's verification process rather than relying on the message.
The request is independently confirmed before any payment is made.
6. PRACTICAL BUSINESS CHECK
Teach employees to pause when a request:
□ Involves unusual urgency. □ Changes normal payment procedures. □ Requests secrecy. □ Uses a new communication channel. □ Requests a new beneficiary. □ Attempts to bypass approval. □ Asks for authentication secrets.
WHY THIS MATTERS
The safest response to a high-impact request is not blind obedience or automatic rejection. It is appropriate verification.
VERIFY BEFORE YOU TRUST.
A person's apparent authority is not independent proof that a payment request is genuine.