حماية التنفيذيين من انتحال الهوية

• Do you have a process to monitor fake profiles using your name and photo on social networks and messaging apps? — Fake executive profiles are used to ask staff, suppliers and relatives for money. The sooner they are found and reported, the smaller the damage.
• Are look-alike domains of your company (swapped letters, other endings) monitored? — Emails from near-identical domains are the backbone of CEO fraud and supplier bank-detail changes.
• Has your personal data (address, ID number, phone, plate) been removed from public sites and listings where possible? — Exposed data fuels social engineering, family scams and physical risk. LGPD and similar laws allow deletion requests in many cases.
• Do you limit what you post in real time (location, schedule, travel, routine)? — Knowing the executive is on a flight or in a meeting is what lets a scammer say 'they can't take calls right now'.
• Has your family agreed on an emergency code word and knows to hang up and call back a known number? — AI voice cloning makes 'emergency' calls very convincing. The FTC advises hanging up and calling back a number you already know.
• Have children, spouse and personal assistants been briefed on scams that use the executive's name? — Family and close staff are often the easiest link: they get urgent requests 'on behalf of' the executive.
• Are family members' social profiles private and free of routine details? — School, home and travel photos help scammers build credible stories and choose targets.
• Before international trips, do you use a phone and laptop with minimal data and accounts? — Devices can be lost, inspected or stolen. Less data on the device means less exposure.
• Do you avoid public Wi-Fi or always use a secure connection (mobile data or corporate VPN)? — Hotel and airport networks can be fake or monitored.
• Are itinerary and hotel shared only with those who need to know? — A leaked travel schedule enables scams ('I'm stuck at the airport') and physical risk.
• Do email, messaging, banking and social accounts use strong authentication (passkey, authenticator app or hardware key), not only SMS? — SMS can be diverted by SIM swap. Phishing-resistant factors better protect high-value accounts.
• Do WhatsApp and similar apps have two-step verification with a PIN turned on? — Without the PIN, anyone who gets the activation code can take over the account and message your contacts as you.
• Are your devices updated, screen-locked and set up for remote wipe? — Updates close flaws attackers exploit; remote wipe limits damage after theft.
• Are payment requests, bank-detail changes or data requests 'from the CEO' always confirmed by calling a number already on file? — The FBI recommends confirming transfers through a second channel agreed in advance and never using the contact details in the request itself.
• Does the team know the executive's official channels and that they never ask for secrecy to skip processes? — 'It's confidential, don't tell anyone' is the most common line in CEO fraud.
• Is there a code word or verification question for sensitive requests made by voice or video? — Voice and video deepfakes of executives have been used in fraud. A secret agreed outside the channel defeats the scam.
• Do payments above a threshold require approval by two people (dual control)? — Dual approval stops a single pressured employee from completing a fraudulent transfer.
• Do supplier bank-detail changes go through independent confirmation and a waiting period? — Supplier account changes are one of the costliest business scams. The FBI cites sudden payment-destination changes as a red flag.
• Do personal and family office accounts have transaction alerts and adjusted daily limits? — Instant alerts and low limits on instant payments and transfers reduce losses when something slips through.

1. Define official channels — Write down the only channels the executive uses for internal requests. Requests through any other channel are treated as suspicious.
2. Agree on a code word — A word or question agreed in person, changed periodically and never sent by message.
3. Call back a known number — For any urgent request, hang up and call the number already on file. Never use the number, link or email in the request.
4. Require dual approval — Payments above the threshold and any bank-detail change need two people, with a record.
5. Secrecy is a red flag — No executive asks to skip processes in secret. Anyone receiving such a request is backed to refuse and escalate.
6. Cooling-off period for changes — New payees and changed accounts are paid only after independent confirmation and a set waiting time.
7. Log and report — Every attempt is logged and reported to security, the bank and the police when there is a loss.
8. Train and test — Regular simulations with assistants, finance and family keep the protocol alive.

EN · PT · ES · FR · ZH · AR