Executive Impersonation & Account Takeover Defence

About this program

Risks addressed

• Critical Clone CEO LinkedIn used in CEO-fraud phishing
• Critical Deepfake voice / video used in wire-transfer scam
• High Customer-facing scam runs on a lookalike support handle

Controls (6)

1. Monitor for impersonation accounts on top platforms

   High

   This control establishes a systematic process to identify and address fraudulent social media and online platform accounts that impersonate the organization, its brands, executives, or official representatives. Monitoring spans major platforms including Facebook, Twitter/X, LinkedIn, Instagram, TikTok, and relevant industry-specific…

   How to test + evidence

   Testing procedure: Brand-protection tool (or manual sweep) flags clones of named executives + corporate handles.

   Evidence to collect: Monitoring tool config / weekly report.

2. Reporting workflow with each platform

   High

   This control establishes documented, platform-specific reporting workflows that define how security incidents, vulnerabilities, compliance findings, and operational alerts are escalated, triaged, and resolved within each technology platform or service used by the organization. Each platform (e.g., cloud provider, endpoint protection,…

   How to test + evidence

   Testing procedure: Documented contacts + workflow at LinkedIn / Meta / X / TikTok for impersonation takedowns.

   Evidence to collect: Takedown contacts + last 5 cases.

3. Executive accounts verified (blue badge / equivalent)

   Medium

   This control requires that executive-level user accounts, which typically have elevated privileges or access to sensitive information, be authenticated using verified identity credentials such as government-issued photo identification (blue badge) or equivalent enterprise-grade identity proofing. The verification process ensures a…

   How to test + evidence

   Testing procedure: Where available, verification reduces clone effectiveness.

   Evidence to collect: Verification screenshots.

4. Out-of-band verification for finance requests

   Critical

   Out-of-band verification for finance requests requires that payment, wire transfer, vendor changes, and other financial transactions be confirmed through a secondary communication channel independent of the original request medium. When a finance team receives an email requesting payment or account…

   How to test + evidence

   Testing procedure: Wire-transfer / payment changes require call-back on a known number, not from new requester.

   Evidence to collect: Finance policy + call-back log.

5. Awareness training covers deepfake + CEO-fraud

   High

   This control requires that security awareness training explicitly covers social engineering techniques leveraging deepfake technology (synthetic audio, video, or images) and CEO fraud (business email compromise targeting executive impersonation). Training must educate employees on recognizing manipulation tactics such as voice-cloned…

   How to test + evidence

   Testing procedure: Annual training + simulated CEO-fraud phishing test.

   Evidence to collect: Training content + simulation results.

6. Public PR / comms response plan for executive scam

   Medium

   This control establishes a documented public relations and communications response plan specifically designed to address executive impersonation scams, including CEO fraud, Business Email Compromise (BEC), and deepfake impersonation. The plan defines roles, approval workflows, pre-approved messaging templates, stakeholder notification sequences,…

   How to test + evidence

   Testing procedure: Pre-drafted public response if an impersonation campaign scales.

   Evidence to collect: Comms template library.