Security for executives: you are the target

How attackers use leaders

Impersonating you. The most common pattern is an email, text, or message that looks like it comes from you, asking a staff member to pay an invoice, change a supplier's bank details, buy gift cards, or send employee tax records. It often arrives when you're traveling or in meetings, so it can't be checked easily. This is business email compromise, and the FBI's IC3 reports it among the costliest types of cybercrime it tracks.

Voice and video impersonation. AI tools can now imitate a voice from a short recording, and fake video calls have been used in real fraud cases. A familiar voice on the phone is no longer proof on its own.

Taking over your accounts. Phishing aimed specifically at a senior person (sometimes called whaling) is usually more polished: a fake board document, a legal notice, a DocuSign-style request. If your email account is taken over, the attacker can send real messages from you.

Taking over your phone number. In a SIM swap, an attacker convinces your mobile carrier to move your number to their SIM card. Every text-message code then goes to them.

The protections that matter most

1. Use the strongest sign-in you can

For your email, banking, payroll, and identity provider accounts, use passkeys or a hardware security key where supported. These resist phishing in a way that text-message codes and even authenticator apps don't, because they only work on the real website. Register a backup key or passkey and store it safely.

2. Lock down your mobile number

• Ask your carrier to add a port-out PIN or number lock to your account. Most major carriers offer one.
• Move important accounts off text-message codes to an authenticator app or passkeys.
• Be suspicious if your phone suddenly loses signal with no explanation. Call your carrier from another phone.

3. Separate your everyday account from admin powers

Many owners are the super admin on Google Workspace or Microsoft 365, the domain registrar, and the website, all from the same account they use for email. If that account is phished, the attacker gets everything. Use a separate admin account, with strong two-factor, that you only sign into for admin tasks.

4. Make verification the rule, and say so

Agree with your team, in writing (see writing a security policy):

• Any request from you to move money, change bank details, or share sensitive data gets confirmed by calling you on a known number, or in person.
• You'll never ask for gift cards.
• No one gets in trouble for checking, even if you're annoyed in the moment.

Some leadership teams agree a verbal code word for urgent requests. It's low-tech and works against voice cloning.

5. Reduce what's public

• Review what your company website, LinkedIn, and social accounts say about your role, direct reports, travel, and email format.
• Avoid posting travel plans in real time.
• Data broker sites list home addresses and phone numbers. You can request removal from many of them, or use a paid removal service.
• Keep personal and business social accounts separate, and secure both. See securing your social media accounts.

6. Protect your personal accounts too

Attackers move between personal and work life. A compromised personal email can be used to reset a work account, or to impersonate you to family who then contact staff. Apply the same two-factor and password manager habits at home.

7. Travel carefully

• Bring only the devices you need.
• Keep devices updated and encrypted, with a short screen lock.
• Use your phone's hotspot rather than hotel or café Wi-Fi for sensitive work. See device and Wi-Fi security basics.
• Tell your finance contact when you're traveling, so they're extra careful with any "urgent" request in your name.

What your executive assistant needs

If someone manages your inbox or calendar, they're a target too. Give them delegated access rather than your password, make sure their account has the same strong two-factor, and include them in the verification rule.

Frequently asked questions

Related guides

• Keeping your accounts & website safeBusiness email compromise explainedWhat business email compromise (BEC) is, how it works, and the steps every small business can take to prevent it.
• Keeping your accounts & website safeHow to recognize phishing attemptsLearn to spot fake emails, texts, and websites before you click: practical warning signs explained in plain English.
• Keeping your accounts & website safePasskeys, explainedPasskeys are a new, password-free way to log in that is more secure and easier than passwords. Here is what they are and how they work.
• Keeping your accounts & website safeSecuring your social media accountsHow to protect your Facebook, Instagram, LinkedIn, and other social media accounts from hackers and unauthorized access.
• Security for your companyIncident response: who does what in the first hourA first-hour incident response plan for small companies, with roles, a call order, and the mistakes that make a security incident worse.

Learn more

• FBI: Business email compromisefbi.gov
• FBI: Internet Crime Complaint Center (IC3)ic3.gov
• CISA: More than a password (multifactor authentication)cisa.gov
• FTC: Business email impostersftc.gov