News

Phishing and CEO fraud: how to spot them and which protocol to follow

Signs of CEO fraud and phishing, a payment verification protocol and what to do if you have paid: bank, police report in Andorra and Catalonia, training.

Published By BDR Group8 min read

CEO fraud is a variant of phishing in which someone poses as an executive or a supplier to obtain an urgent payment. You recognise it by the rush, the secrecy and the change of channel. You neutralise it with a simple rule: no new or changed payment is made without confirming it through a second channel you already know.

What each one is

Phishing is deception aimed at getting someone to click a link, hand over credentials or obey a false request. INCIBE, Spain’s national cybersecurity institute, describes CEO fraud as a form of phishing in which an employee with the authority to make transfers receives a message that appears to come from a superior (CEO, chairman or director) asking for an urgent, confidential financial operation. The Mossos d’Esquadra, Catalonia’s police force, distinguish a telephone variant from an email variant, and a variant in which a supplier is impersonated and a new account is given for paying invoices.

It is not a minor risk. The ENISA Threat Landscape 2025 report, from the EU cybersecurity agency, analyses nearly 4,900 incidents between July 2024 and June 2025 and places phishing (together with vishing, spam and malicious advertising) as the main route in, at around 60% of cases. It adds that AI is used to write more convincing emails and to impersonate people with fake voices and videos.

How to recognise it

Warning signs, according to INCIBE and the Mossos:

  • Urgency: "the transfer has to go out before 14:00".
  • Secrecy: "don’t mention it to anyone".
  • Excuses for not talking: "I’m in a meeting and can’t call".
  • Change of channel: you are asked to continue on WhatsApp.
  • Chosen moment: the executive is on holiday or cannot be reached.
  • Misleading sender: a domain that is almost identical, with one letter changed.
  • Strange forms of payment: gift cards, cash or deposits at cryptocurrency ATMs.
  • New account: a transfer to an account different from the usual one, often in countries with some degree of fiscal opacity (Mossos).

In Andorra, the Police warned on 4 February 2026 of new telephone cases with losses of 700 to 3,000 euros. The fraudsters call an establishment posing as the manager or a supplier, using real business details, and press the employee to hand over money urgently: from the till or the safe, from their own pocket, or by buying prepaid cards and sending the codes as a photo. They start by asking for little and, if they see willingness, ask for more, and they may imitate a voice with AI. According to the Police, it affects different types of establishments, services and institutions.

Payment verification protocol

It draws on the recommendations of INCIBE, the Mossos and the Andorran Police, and fits on one page:

  1. Confirm through a second channel. Call a number you already have, never the one in the message or the one you are given when they call. Apply this to any urgent payment request or one outside the usual procedure.
  2. Verify account changes. A change of a supplier’s IBAN is not made without confirming it by phone with the known contact.
  3. Double authorisation. Transfers above a set amount are approved by a second person.
  4. Define who can order payments and how. With a written protocol, an organisation chart and official contacts.
  5. Nobody pays out of their own pocket or buys cards on request. No company procedure asks for it, and every employee must know that.
  6. Allow doubt. Verifying a manager’s order must be an obligation, not a sign of distrust: fraudsters count on the fear of the person receiving the request.
  7. Email filters. Set up alerts for domains similar to the company’s and for external emails that imitate internal names.

What to do if you have already paid

Time counts, because by the time the fraud is detected the receiving accounts are often no longer operational (Mossos).

  1. Alert the bank immediately, from an official telephone or channel, and ask it to try to stop or recover the operation.
  2. Keep the evidence. Do not delete the email or the message, take screenshots of the impersonation and note times, numbers and accounts.
  3. Report it. In Andorra, to the Andorran Police: its website states that emergencies and reports are handled 24 hours a day, 365 days a year, on 110 or +376 872 000. In Catalonia, to the Mossos d’Esquadra, with the email received and the evidence. In the rest of Spain, to the Policía Nacional or the Guardia Civil.
  4. Call INCIBE (017) if you are in Spain: it is a free, confidential service for citizens, businesses and professionals, every day from 8:00 to 23:00 (also by WhatsApp, on 900 116 117).
  5. Assess whether personal data has been compromised. If the attackers have got into a mailbox or a system, it may be a personal data breach. The GDPR (Article 33) and Andorra’s Llei 29/2021 on personal data protection (Article 36) require it to be notified to the supervisory authority without undue delay and, where feasible, within 72 hours, unless it is unlikely to result in a risk to individuals.
  6. In Andorra, Llei 22/2022 on the security of networks and information systems allows cyber threats and incidents to be reported voluntarily to the CSIRT-AD, including by entities outside its scope (Article 16).

Training: what everyone needs to know

The protocol only works if the person who takes the call knows it. All staff should be trained, not just finance, and especially anyone with access to the till, to invoicing or to the management mailbox. We recommend short sessions, with real examples and repeated every year, that include the telephone call: not everything arrives by email.

Our interest in this topic

At BDR Group we offer cybersecurity training and awareness and incident response with TutumSec, so we have an interest in this topic. The protocol above can be put in place without buying anything.

What to do now

  1. Write the payment and account-change protocol on one page and make sure all staff receive it.
  2. Set the amount above which two approvals are needed.
  3. Make it clear that nobody pays or buys cards on the order of a phone call.
  4. Note down the telephone number of the bank and of the Police or the Mossos, and who raises the alarm if it happens.
  5. Schedule a 30-minute training session and repeat it every year.

Frequently asked questions

Can it be a phone call, not just an email?

Yes. The Andorran Police alert of February 2026 describes telephone cases, with real business details and possible use of AI-imitated voices. The Mossos describe one telephone variant and one email variant.

Can the money be recovered?

There is no guarantee. The Mossos warn that it is often impossible to recover the money, because the receiving account stops being operational. That is why alerting the bank immediately is the first step.

Do I need to report it if the amount is small?

The sources we cite recommend reporting and set no minimum amount. The cases in the Andorran alert were between 700 and 3,000 euros.

Sources

Want to review how your company protects its payments?

If you want an outside opinion on procedures, training and incident response, start with the service page: Cybersecurity for businesses

Back to News

News

More articles