Business email compromise: how scammers pose as your Executive Director

In a business email compromise scam, someone pretends to be your Executive Director, a board member or a trusted supplier, usually by faking their email address or display name, and sends an urgent request for money. There's no virus and no suspicious attachment, just a message that looks normal. CORE's Email Security stops many of these phishing attempts before they reach an inbox, and a simple verification habit catches many of the rest. You can check how easy your domain is to impersonate with the free Domain Security Scan.

Key takeaways

• Business email compromise (BEC) scammers pose as your Executive Director, board chair or a supplier to ask for urgent payments.
• These scams work on human trust, not software flaws, so there's often no malware for antivirus to catch.
• A phone call to a number you already have, never the number in the email, can stop the loss before money leaves.
• Domain and email security make it harder for a fraudulent request to arrive in the first place.

What is a business email compromise scam?

Business email compromise is a common and costly kind of online fraud. It works because email feels familiar and trustworthy, and because most organizations approve payments by email every week.

In a BEC scam, a criminal sends a message that appears to come from someone you know, asking for something that looks routine: pay this invoice, buy these gift cards, update this supplier's banking details. The sender looks real. The request looks normal. That's the whole trick.

How does a BEC scam typically unfold?

Scammers first study how your organization works. Your website, annual report and social media often tell them who the Executive Director is, who sits on the board and who handles the books. Then they write a message that matches those patterns: the right names, the right tone, a believable reason for urgency.

The email arrives from a familiar name. The request feels urgent but reasonable. Someone who wants to be helpful acts on it before checking.

Why do BEC scams succeed so often?

They exploit trust and good intentions, not technical weaknesses. There's no attachment to scan and no link to block, only a person being asked to do something that looks like part of their job. At a small non-profit, where people wear many hats and want to support leadership, that pressure is hard to resist.

How does the executive impersonation scam work?

An executive impersonation scam combines authority with urgency. The scammer either fakes the sender's display name, registers a lookalike domain (for example, swapping one letter in your organization's name) or, in some cases, takes over a real email account. Then they send a message that appears to come from a leader, asking for a quick favour.

What does a CEO fraud email look like at a non-profit?

Here's a common example. On a Friday afternoon, the office manager gets an email that seems to be from the Executive Director: "I'm in meetings all afternoon. Can you pick up ten $100 gift cards for our volunteer appreciation event? Please send me the card numbers by reply so I can get them out today." The request sounds kind, the timing makes it hard to check, and the gift cards are gone the moment the numbers are sent.

A second version targets payments directly. The bookkeeper receives a message that appears to be from the board chair: "We need to send this payment today or we'll miss the grant deadline. I've attached the details. I'll sign off on it at the next meeting." The urgency and the authority are the point. Both are designed to stop you from checking.

How do scammers trick finance staff?

Another common pattern uses a supplier your organization already pays, such as your event venue or printer. Just before a payment run, the board treasurer or a finance volunteer receives an email that seems to come from that supplier: "We've changed banks. Please use the updated details below for this and future payments." The invoice amount is right, the logo is right and the timing makes sense. Without a quick check, the payment goes to a criminal's account and is very hard to recover.

What are the warning signs of a BEC email?

Watch for these signs, especially when two or more appear together:

• Urgency: "today", "before the deadline", "right away".
• Secrecy: "keep this between us", "don't mention it to the board yet".
• Unusual channels: a request to pay in gift cards, crypto or to a new account.
• Changed banking details sent by email alone.
• A sender address that doesn't quite match: a free webmail account, or a domain with one letter changed.
• A leader who is "unavailable": in meetings, travelling or unable to take a call.
• Replies going somewhere else: the "reply-to" address is different from the sender.

How can your organization verify before paying?

Verification stops business email compromise before money leaves your account. Criminals rely on urgency and authority to get past your normal checks, so the fix is a check that never gets skipped.

What makes a verification call effective?

Three rules make verification calls work. First, never use the phone number in the suspicious email. Second, call a number you already have on file, or speak to the person directly. Third, confirm the details out loud: the amount, the account and the reason for the payment.

What should a simple payment-verification policy include?

Write these down and share them with everyone who touches money, including volunteers:

1. Two-person approval: any payment over an amount your board sets needs a second approver.
2. Call-back to a known number: every new payee and every payment request made by email gets a phone call to a number already on file.
3. No banking changes by email alone: changes to a supplier's banking details are only accepted after a call-back.
4. No gift cards on request: gift cards are never bought because of an email or text, no matter who it appears to come from.
5. Permission to pause: staff and volunteers are told they will never be in trouble for checking first.

If money has already been sent, contact your bank right away and report the fraud to the Canadian Anti-Fraud Centre.

Why does domain security matter for verification?

Scammers impersonate your domain to make CEO fraud emails look real. CORE includes Domain Security (DNS security, registration and administration), which makes your domain harder to impersonate, and Email Security, which stops spam, phishing and malicious attachments before they reach inboxes. Setting up email authentication (SPF, DKIM and DMARC) adds another layer. Together, these reduce the chance a fraudulent request ever arrives. Learn more about our domain security approach.

CORE costs $23 per user + $26 per device = $49 per seat per month, before applicable taxes, and our Fair Play™ pricing means no minimums, no long-term contracts and no hidden fees. It's how we Make IT Disappear: the protection works in the background so your team can focus on the mission.

FAQ

How does a business email compromise scam work?

A scammer fakes the email address or display name of your Executive Director, a board member or a supplier, then sends an urgent request for money. It relies on trust, not malware.

What does a CEO fraud email look like?

Often a time-sensitive request, such as an Executive Director asking an office manager to buy gift cards, or a "supplier" sending new banking details just before a payment run.

How can our organization verify a suspicious payment request?

Call the person or supplier on a number you already have, never the number in the email, and confirm the amount, account and reason before any money leaves.

Conclusion

A business email compromise scam only succeeds when someone acts without checking. A single phone call to a known number can stop the fraud before money leaves your account. Build verification into every payment process, and tell your team it's always okay to pause when urgency and authority show up together.

Start with the free Domain Security Scan to see how easy your domain is to impersonate, or call us at 1-888-274-3530.