How To Respond To Executive Impersonation.

An executive impersonation alert means someone has made a fake profile, page or account that uses the name, photo or role of a senior person in your company. It may sit on a social network, a professional network or a messaging app. The aim is usually to trick staff, partners or customers.

The fake profile can be used for fraud. In business email compromise (BEC), a criminal pretends to be a trusted person to get a money transfer or private data. The FBI describes BEC as a scam aimed at businesses that make legitimate transfer-of-funds requests. First, confirm with the executive that the profile is not theirs.

The goal is to get the profile taken down and stop staff acting on it. Report through each path below, with the same evidence.

• Platform abuse form: use the impersonation report on the social or professional network. State the real person's name, give the fake profile address and attach proof of identity if the platform asks.
• Registrar abuse contact: if the fake links to a lookalike domain, report it to the domain registrar's abuse contact and ask them to suspend it.
• Hosting provider abuse contact: report any fake web page to the host named in the domain's lookup record.
• Email provider abuse team: report fraud sent from a free mail account to that provider.
• Search or ad platform report: if the profile shows in search results or ads, use that platform's report form.
• Law enforcement or national CERT: for fraud or money lost, file with your national police or CERT. In Turkiye, USOM (usom.gov.tr) says its services, including incident reports, now continue on the Cyber Security Directorate site (siberguvenlik.gov.tr). In the US, file with the FBI IC3, and call the bank at once if money was sent. The NCSC in the UK also takes reports of scam messages and websites.

Make the impersonation harder to profit from, even when a fake exists.

• Set a verification rule for payments and data requests: confirm by phone to a known number.
• Verify account changes on a second channel. The FBI advises using secondary channels or two-factor authentication to verify requests to change account details. CISA recommends MFA on email, financial and social media accounts.
• Limit public detail. NCSC advises being mindful of personal information shared online because criminals use it to craft convincing attempts.
• Tighten privacy settings on executives' social accounts.
• Verify the real profiles where the platform allows it and link them from your website, so staff know which are real.
• Brief assistants, finance and HR on how the executive normally asks for things.
• Write down the incident plan, using NIST SP 800-61 Rev. 3 as a base.

Track what you can count from your own reports and tickets.

• Number of fake profiles found and number removed.
• Time from the alert to the platform report and to removal, tracked over time, not promised.
• Number of staff or partners who were contacted, and how many replied.
• Payment requests blocked by the verification rule.
• Repeat profiles for the same executive.
• Staff who finished the short briefing on verifying requests.

These slow down removal or leave staff exposed.

• Reporting without saving evidence first.
• Contacting the executive through the fake profile.
• Telling no one in finance because "nothing happened yet".
• Sending a vague report to the platform with no proof of identity or profile address.
• Reporting the profile but ignoring the lookalike domain it links to.
• Making public statements before legal and communications agree on wording.
• Closing the alert after removal and not watching for a new copy.