“Urgent orders from fake bosses” have become one of the most common and most effective scams in the workplace. Their success comes from the fact that criminals impersonate executives or colleagues in order to create fear, urgency and pressure. Through messages, calls or legitimate-looking emails, they manage to manipulate their victims until they obtain money, confidential information or access to internal systems.
This article explains how these scams work, which signals help identify them, and what measures to take in order to avoid falling for them.
What does this scam involve?
Scams disguised as orders from a boss are built on the imitation of figures of authority. The goal is for the victim to act quickly, without questioning the instruction.
How they convince the victim
The criminals recreate scenarios that appear urgent and catastrophic. They may mention unexpected audits, imminent fines or legal problems. Emotional pressure is a key part of the deception: they want the person to act without stopping to think.
In most cases these situations are false, but they are designed to sound credible and to provoke fear.
The psychological elements they use
1. The authority of the supposed boss
Scammers impersonate executives or colleagues from sensitive departments, such as accounting or legal. They take advantage of the fact that the victim recognizes the names, but not necessarily the exact way those people write or speak.
Fake profiles usually imitate:
- The executive's real name
- Their position within the company
- A photo or publicly available information
Even when they look authentic, small details can give the impersonation away.
2. Extreme urgency
The scam relies on time pressure:
- “The audit is tomorrow.”
- “The supplier needs the payment today.”
- “We have minutes to avoid a penalty.”
This urgency is meant to keep the victim from verifying the information.
3. Absolute secrecy
The criminal insists that nobody else should find out. They claim that sharing the information could lead to dismissals, penalties or legal problems. Isolation is essential for the scam to work.
4. Contact with fake third parties
It is common for the supposed boss to redirect the victim to speak with a supposed official, auditor or outside adviser. That person is also part of the scam and serves to reinforce the deception.
What the scammers are after
The goal can vary depending on the victim's position and level of access.
🔐 Stealing company money
If the person has access to funds or approvals, the criminals will ask for:
- Urgent payments to fake suppliers
- “Confidential” transfers
- Deposits to resolve supposed legal problems
All of it under the promise of reimbursing the expense later.
🧩 Obtaining sensitive information
If the victim does not handle funds, they will try to obtain:
- Passwords
- Access to internal systems
- Financial or personal data
- Valuable operational information
They may even try to get the victim to put up their own money, with the excuse that it will be reimbursed.
How they make the scam look real
The criminals use information gathered from social networks, public pages and data leaks. With that they can:
- Learn internal hierarchies
- Find out the name of the direct manager
- Identify teams and departments
- Recognize the location of offices and desks
- Recreate messaging profiles that look authentic
In more advanced attacks they may use voice or video deepfakes, impersonating an executive during calls or video calls.
Technical aspects of the deception
📧 Fake emails or messages
They can create:
- New accounts that imitate real addresses
- Instant messaging profiles with the boss's name and photo
- Corporate accounts stolen through earlier attacks
These techniques belong to what are known as BEC (Business Email Compromise) attacks.
📞 Phone number spoofing
Using spoofing tools, they make the number that appears on screen match the company's or the real boss's. They can even obtain illegal copies of SIM cards in order to use the genuine number.
How to protect yourself from a fake boss
🧘 Stay calm and verify
Scammers need to create panic. Taking a deep breath and pausing for a few seconds makes it possible to think clearly.
If the call is insistent, you can hang up and “pretend there was a connection problem”, then verify the information through another channel.
📡 Check the communication channel
If your boss always writes through one channel and suddenly uses another, that is a reason for suspicion.
It is also essential to look at:
- The email address
- The phone number
- The username
- The previous conversation history
A recently created profile is a red flag.
🗣️ Detect changes in the way someone communicates
Any difference in tone, vocabulary or level of formality should raise doubts.
A personal or internal question that only the real person could answer can help confirm their identity.
🚫 Never act without confirming through another channel
Before making a payment or sharing information:
- Call the boss at the number saved in your contacts
- Write through the normal communication channel
- Go in person if possible
Never use the number or contact details provided by the supposed boss.
🤝 Check with colleagues
Even if they ask you to keep it secret, verifying with another colleague in the department can stop the scam from moving forward.
📢 Report it immediately
If you detect an attempt:
- Notify the security department
- Warn your colleagues
- Report it to the authorities
If an attack fails with one person, they will try it with someone else.
Scams that imitate urgent orders from bosses rely on authority, fear and haste. Recognizing the patterns and maintaining verification habits can make the difference between falling for a scam and stopping it in time. Whenever there is any doubt, the essential step is to confirm the information through alternative channels and alert your internal teams.
