Executive impersonation is straightforward to execute — a photograph, a title, a plausible profile — and effective because the people contacted have no established relationship with that individual and no easy way to verify.

What impersonators do

  • Message customers offering investment opportunities, discounts, or refunds.
  • Message staff with urgent requests, frequently for gift cards or payment changes.
  • Announce fake giveaways or token offers to your audience.
  • Approach partners and suppliers about changed payment details.
  • Post commentary that appears to be your company's position.

Detection is mostly social

You will usually learn about it from a customer or employee who found it odd. Make that easy: publish a route for reporting suspected impersonation, and respond quickly when someone uses it. Periodically search each major platform for your executives' names and your company name.

Reporting works, slowly

Every major platform has an impersonation process, and verified business accounts generally get faster handling. Report with clear evidence: the genuine profile, the fake, and examples of the impersonation. Expect it to take time, and expect replacements — persistence matters more than any single takedown.

Set expectations publicly

Publish what you will never do: contact customers privately about investments, ask for payment by gift card or cryptocurrency, or change bank details by message. Name your official accounts. This gives your audience a reference point and makes impersonation attempts fail earlier.

Internally, protect against the request variant

Staff should know that a message from a senior person asking for an unusual payment gets verified by a known channel, and that doing so will never be treated as insubordination. The technical controls do not help here; the permission to verify does.

If your own account is compromised rather than copied

Treat it as an incident: secure the linked email first, reclaim the account, revoke sessions and connected applications, check for added administrators, and warn your audience quickly. Every hour of attacker control is time spent defrauding people who trust you.