Why scammers pretend to be the boss
Staff are trained, quite rightly, to be helpful and to act on what the owner asks. A message from the boss carries authority that a message from a stranger doesn't. Scammers know that a junior team member is unlikely to question a director, especially if the message hints that the director is in a meeting, travelling or dealing with something confidential.
Small businesses are often easier targets than large ones. The owner's name is on the website, LinkedIn shows who works in accounts, and there is no formal finance department with layered approvals. A single person with access to the bank account may be the only check between the scammer and the money.
What these messages typically look like
They often start small: 'Are you at your desk? I need a quick favour.' Once the staff member replies, the request follows. It might be a payment to a new supplier for a deal that must close today, a batch of gift cards for client gifts, or a copy of the staff payroll for an accountant. The sender usually says they can't take calls right now.
The email address may be a free webmail account using the boss's name, a lookalike domain one letter off yours, or occasionally the boss's real mailbox if it has been compromised. Text messages and WhatsApp are used too, with a line like 'this is my new number, my phone broke'. Increasingly, scammers also use AI-cloned voices from short clips found online, so a phone call that sounds like the boss is no longer proof on its own.
Set a verification rule from the top
The most effective defence is a rule the owner announces personally: 'I will never ask you to pay a new account, buy gift cards or send payroll or client data by email or text without confirming it with you directly. If you get a request like that, call me on my usual number or ask me in person, and don't worry about interrupting me.' When the owner says it, staff feel safe to check.
Some offices add a simple code word for urgent money requests, known only to the people who approve payments and never written in email. If the voice on the phone or the message can't give it, the request stops. This is especially useful now that voice cloning makes a familiar voice less reliable.
Technical steps that reduce the risk
Configure your email system to tag messages from outside the organisation with a visible banner, so a message claiming to be from the boss but marked 'external' stands out. Most business email platforms can also warn when an external sender uses the same display name as an internal staff member, which catches many impersonation attempts.
Protect the real mailboxes of senior people with strong multi-factor sign-in, because a hacked director's account is the most convincing impersonation of all. Publish a DMARC record for your domain so others can't easily send mail from your exact address, and consider registering obvious lookalike domains if your brand is a frequent target.
Train staff on the pattern, not just examples
Examples date quickly, so teach the pattern instead: urgency, secrecy, an unusual payment method, and a reason the sender can't be contacted. Any message with two or more of those features should be checked through another channel. Short, regular reminders work better than one long session a year. Most importantly, thank people who check, even when the request turns out to be genuine. If a staff member is criticised for delaying a real payment to confirm it, the whole team learns that checking is unwelcome, and the next fake request will go straight through.
Keep less of the playbook public
You can't remove every clue an attacker uses, but you can make their research harder. Consider whether your website needs to list every staff member with a direct email address, or whether a general enquiries address would do for most roles. Encourage senior people to be careful about posting travel plans on social media, since 'the boss is overseas' is a favourite cover story.
Internally, avoid discussing payment approvals in long email chains that copy many people. The fewer places that show who signs off payments and how, the less an attacker learns if one mailbox is compromised. None of this replaces verification, but it removes some of the easy material. It also means a single compromised inbox exposes far less about how money moves through the business.
In short
- The owner should personally announce a 'we always confirm' rule.
- Urgency plus secrecy plus an unusual payment method means stop and check.
- A familiar voice on the phone can be faked; use a code word for urgent payments.
- External-sender banners and display-name warnings catch many fakes.
- Thank staff who check, every time.