There's a particular kind of email that finance teams have learned to dread. It comes from the CEO, or the CFO, or a trusted partner firm. The tone is right. The timing makes sense. It references a real project. And it asks, politely or urgently, for a payment to be made or a bank account to be updated right now.

Increasingly, that email isn't from your executive at all. It's from an attacker wearing your executive as a mask. We call this a Ghost Executive attack, and it's become one of the most effective forms of payment fraud we see. By some estimates it now accounts for around 40% of payment fraud attempts, and the reason it works is uncomfortably simple: it targets people and process, not firewalls.

What a Ghost Executive attack actually is

A Ghost Executive attack is a form of business email compromise (BEC) in which a fraudster impersonates a senior figure: a chief executive, a finance director, a lawyer, or a supplier your team already trusts to authorise a fraudulent payment or reroute a legitimate one.

Unlike the clumsy phishing of a few years ago, these attacks don't rely on obvious spelling mistakes or wild promises. They rely on authority and urgency. When a request appears to come from the top of the organisation, employees are far less likely to question it and attackers know exactly how to exploit that instinct.

Why it's getting smarter

Three things have made this threat far more convincing than it used to be.

AI can now fake an entire conversation. Attackers no longer send a single suspicious message. Using AI tools, they can generate whole email threads, complete with back-and-forth replies, forwarded context, and a plausible history so the final payment request looks like the natural next step in a discussion that's already been happening.

Your public footprint is the raw material. Public posts, conference videos, podcast appearances, and company websites give attackers everything they need to mimic an executive's tone, vocabulary, and sign-off. A few minutes of a leader speaking publicly is enough to imitate how they write.

Professional services firms are prime disguises. Accountants, law firms, and consultancies are frequently impersonated, because their emails routinely carry financial instructions. A message that appears to come from your external advisor rarely raises an eyebrow.

Put together, these give attackers the ability to insert an urgent invoice or a "quick" bank-detail change into a thread that otherwise looks completely genuine.

What it looks like in practice

A typical Ghost Executive attack follows a recognisable pattern. Learning to spot the shape of it is the single most useful defence a finance team can have.

• A look-alike sender. The display name is perfect, but the address is subtly wrong: a .co instead of .com, an extra letter, or a domain that's close but not quite yours.
• Manufactured urgency. There's always a deadline. A deal closing, a supplier waiting, a window about to shut. Urgency is the tool that stops people pausing to check.
• A push for secrecy. "Keep this between us for now." Isolation is deliberate. It prevents the target from asking a colleague who would spot the fraud.
• A reason they can't be reached. The "executive" is conveniently in back-to-back meetings and can't take a call, closing off the easiest way to verify.
• An unusual payment or a changed account. A new beneficiary, a first-time supplier, or an instruction to update banking details always framed as routine.
• A bypass of normal approvals. "I'll sign off on the paperwork afterwards." The whole point is to skip the checks that would otherwise catch it.

No single one of these is proof. Together, they're a pattern worth stopping for.

How to protect your business

The good news is that Ghost Executive attacks are defeated by process, not by technology heroics. Simple, consistently applied checks stop the overwhelming majority of them.

• Verify bank-detail changes out of band. Any request to change payment details should be confirmed using a trusted phone number you already hold on file, never a number supplied in the email itself.
• Treat email threads as unverified, even when they look familiar. A convincing history is now something attackers can manufacture. Familiarity is not authentication.
• Confirm unusual or high-value requests through a separate channel. A quick call, a message on a known internal system, or a face-to-face check breaks the attacker's control of the conversation.
• Check the full sender address and domain carefully. Expand the display name and read the actual address, character by character, especially the domain.
• Consider a private verification phrase. Agreeing a simple internal code word for urgent payment requests gives your team an instant, low-friction way to confirm a request is genuine.

The bottom line

Ghost Executive fraud is designed to exploit trust, hierarchy, and haste. The very things that keep a business moving. That's what makes it dangerous, and also what makes it beatable: the same request that feels urgent in an inbox falls apart the moment someone picks up the phone to verify it.

Simple checks still stop these scams. The most valuable thing you can do today is make sure the people who move money in your organisation know this pattern by name and feel empowered to pause, question, and verify, even when the request appears to come from the very top.

Share this with your finance and leadership teams. A five-minute conversation now is a great deal cheaper than a fraudulent wire later.