Fake executive accounts exploit hierarchy, not a technical flaw. That is why technical controls do not stop them.
A fake social media account in an executive's name is usually the first step of a fraud attempt rather than a phishing campaign. The target is generally not the company but its suppliers and partners.
The typical flow
- The account is created; the photo and past posts are copied from the real one.
- Connection requests go to real contacts; acceptance rates are high.
- An "urgent and confidential" request arrives by direct message.
- Payment or information is requested outside corporate channels.
Detection signals
Account age, a sudden jump in connections, small spelling differences in the bio and an email address resembling the corporate domain. None is sufficient alone; together they are a strong signal.
Preparation
More effective than technical detection is a single rule communicated to suppliers in advance: payment detail changes are verified only through a known channel and a call-back. With that rule in writing the campaign fails.
