1. The “CEO” emails: urgent, confidential wire before 4 pm. You:
Answer: Verify via a known channel before acting. Urgency plus secrecy is the core of business email compromise.
2. You’re asked to skip the usual approval because the deal is secret. That’s:
Answer: A red flag. Legitimate deals still follow payment controls.
3. The best control against CEO fraud:
Answer: Dual approval plus call-back for new payees. Processes that require two people and a call-back stop most attacks.
4. True or myth: business email compromise usually involves malware.
Answer: Myth. Most BEC is pure social engineering — no malware needed.
5. The request comes from the CEO’s personal email address. That’s:
Answer: Suspicious. Moving to personal accounts avoids company security checks.
6. The reply-to address differs from the sender. That’s:
Answer: A red flag. Replies would go to the attacker.
7. An outside “lawyer” contacts you about a secret acquisition. You:
Answer: Confirm with your executives through known channels. Fake lawyers add pressure and secrecy.
8. An employee emails asking to change their salary account. You:
Answer: Confirm with the employee via a known channel. Payroll diversion scams use exactly this request.
9. When do attackers like to strike?
Answer: When people are rushed or away, like before weekends or holidays. Pressure and absence make verification less likely.
10. After a fraudulent payment, the first move:
Answer: Call your bank to request a recall. Fast reporting gives the best chance of recovery.