Executive impersonation

Types of executive impersonation, and how to spot them.

Executive impersonation is when someone pretends to be a company's leaders, staff or recruiters to get money, data or access. Here's what it looks like, who it targets and how organisations get the fake profiles, numbers and job offers taken down.

See executive impersonation protection Request a takedown

Anatomy of a fake CEO messageExample

JLJane Lee, CEO+61 412 000 218 · not in your contacts1

WhatsApp · 9:12 amHi Sam, are you free? I'm in back-to-back meetings and can't talk.2

I need a favour for a client thank-you. Please keep this between us for now.3

Buy 5 x $200 gift cards and send me photos of the codes.4 I'll sort the expense later.

1
A new numberThe name and photo are copied from LinkedIn. The number isn't the one you have saved.
2
Can't be calledToo busy to talk means you can't check it's really them.
3
SecrecyKeeping it quiet stops you asking a colleague, who'd spot it.
4
The askGift cards, a transfer or changed bank details. Fast, hard to trace and hard to undo.

Tap a numbered part of the message to see what it means.

What is executive impersonation?

Your leaders' names, used against your people.

Executive impersonation borrows the name, photo or authority of a CEO, board member, manager, recruiter or public spokesperson to make a request feel urgent and legitimate. It targets staff, suppliers, job seekers and customers through WhatsApp, Telegram, LinkedIn and lookalike email addresses. You'll also hear it called CEO fraud or whaling.

CEOJane Lee

EAPriya Shah

FinanceSam Ortiz

Research

Who's who is easy to find.

Company websites, LinkedIn and news stories show who the leaders are, who reports to them and who handles payments.

Jane LeeCEO at Solstice PayNew number · photo copied

Pose

A fake leader appears.

A new WhatsApp number, social profile, Telegram account or lookalike email address takes the leader's name and photo.

Jane Lee, CEOAre you free? Need this done before the board call. Keep it between us.

Ask

An urgent, private request.

Someone who'd normally act on a leader's word is asked to help quickly and quietly, skipping the usual checks.

Gift cards bought5 x $200 · codes sent

Supplier bank details changedNext payment redirected

Payout

Money or data goes out.

Gift cards, transfers, payroll changes or staff data reach the scammer. The account is deleted and a new one starts.

Types of executive impersonation

Eight ways a leader's name gets borrowed.

Some target your staff and suppliers, others your job candidates and customers. Pick one to see how it works.

Jane Lee, CEOWhatsApp · new number

Are you free? I need you to handle an urgent payment before the board call. Keep this between us for now.

Fake CEO messages

Messages from a new number or account using a leader's name and photo, asking staff for a quick favour.

How it works: the message lands with someone who'd normally act on the leader's word, like finance, an assistant or a new starter. It's urgent and private, and the ask is gift cards, a transfer or sensitive data.

Watch forNew numberKeep this between usGift cards or transfers

Executive Impersonation Protection →

JLJane LeeCEO at Solstice Pay

Building the future of payments. DM me for partnership and investment opportunities.

41 connectionsJoined 2026

Fake executive profiles

Social and LinkedIn profiles copying a leader's name, photo and title.

How it works: the profile connects with staff, partners and customers, then uses the leader's authority to pitch fake deals, ask for information or move people to private chats.

Watch forFew connectionsRecently createdInvestment or partnership offers

Executive Impersonation Protection →

From Jane Lee <j.lee@solstice-pay.co>To Sam, FinanceSubject Supplier bank details

Hi Sam, Lumen Supplies have moved banks. Please update their details before today's payment run. Thanks, Jane

Lookalike email addresses

Emails from domains that are one letter, hyphen or ending away from the real one, signed with a leader's name.

How it works: also called business email compromise. The email asks finance to change a supplier's bank details or pay an invoice, and the money goes to the scammer instead.

Watch forChanged bank detailsDomain nearly rightPayment run deadlines

Domain Protection →

Solstice Pay HR TeamTelegram bot · @solsticepay_hr4_bot

Welcome! Earn $45 an hour testing our app from home. Top up your work account with $60 to unlock your first tasks.

Fake recruiters and HR bots

Accounts and automated bots posing as a company's HR or talent team to reach job seekers.

How it works: the job is easy and well paid. Early tasks pay small amounts, then the person is told to pay a fee, top up an account or hand over ID and bank details. When one bot is removed, the next number starts.

Watch forPaying to workTelegram interviewsNumbered bot names

Executive Impersonation Protection →

crewjobs-hub.net/solstice-air-cabin-crew-sydney

Solstice Air cabin crew, Sydney. Apply nowJapanese and Spanish speakers wanted. Pay a $95 assessment fee to secure your interview.Apply →

Fake job ads

Job listings using a company's name and branding on sites it has nothing to do with.

How it works: ads are copied city by city and language by language to reach more applicants. They collect CVs, ID documents and application fees, or send people on to fake recruiters.

Watch forApplication feesNot on the careers pageSame ad, many cities

Executive Impersonation Protection →

Fake endorsements

Ads and fake news articles that put a leader's face and quotes on an investment or product they've never backed.

How it works: a well-known face makes the offer feel safe. The ad leads to a fake article, then to a sign-up form and a "broker" who calls to take a deposit.

Watch forFake news articlesPulled interview claimsGuaranteed returns

Ad Fraud Protection →

Jane Lee VIP SignalsTelegram channel · 2,140 subscribers

Today's VIP pick from Jane. Members made 18% this week. Message my assistant to join the private group.

Investment channels

Telegram and WhatsApp channels using a leader's name to promote trading tips, bonuses or private groups.

How it works: the channel posts "wins" and screenshots to build trust, then sends followers to an "assistant" who takes deposits or fees for VIP access.

Watch forVIP groupsMessage my assistantScreenshots of wins

Scam Protection →

Alex, VIP Host at Solstice Pay @solsticepay_vip_alexCongrats! You've been upgraded to VIP. Send your account email and I'll add your bonus today.

Staff and VIP host impersonation

Accounts posing as account managers, VIP hosts, support staff and spokespeople.

How it works: customers expect to hear from these people, so a friendly message about an upgrade, bonus or problem doesn't raise flags. It ends with a login, a code or a payment.

Watch forUnexpected upgradesPersonal accountsBonus for your details

Social Media Protection →

In the data

What executive impersonation looks like right now.

Patterns from the executive, staff and recruiter impersonations we handled for our clients in the first half of 2026.

100%

of the executive, staff and recruiter impersonations we pursued were confirmed taken down

64%

posed as HR, recruiters or job offers, not the CEO

62%

were on Telegram, many of them automated bots

94%

of fake job ads were removed within a day of being reported

Where the impersonations appeared

Telegram accounts and bots@solsticepay_hr4_bot62%
Fake job ad sitescrewjobs-hub.net/solstice-air30%
WhatsApp, email and other+61 412 000 2188%

43% were automated bots posing as HR or support teams. They can answer hundreds of people at once, and when one is removed the next number starts.

Source: Unphish cases opened January to June 2026 involving fake executives, staff, HR teams, recruiters and job ads. Example names are illustrative. Figures are rounded.

Why leaders get copied

Authority gets things done fast. That's the point.

People act quickly when a request seems to come from the top, and a well-known name makes an offer feel safe. Scammers borrow both, and the damage lands on your people, your candidates and your reputation.

Money moves fast

Finance teams and assistants act on urgent requests from leaders. Gift cards and redirected payments are hard to get back.

Job seekers get hurt

Fake recruiters use your employer brand to charge fees and collect ID documents from people who wanted to work for you.

Leaders' names end up on scams

Fake endorsements and investment channels put your CEO's face on schemes they've never heard of.

$166.8m

reported lost to payment redirection scams in Australia in 2025, where scammers pose as a supplier, colleague or boss. Job scam losses rose 81% to $24.8m.

Source: NASC Targeting Scams report, 2026

Fake recruiters

Fake HR teams run at scale.

Recruitment scams run on numbered bots and copied job ads, so when one goes, the next is already waiting. They need to be linked and removed together.

Bot names with hr, job or support and a number
The same script, task links and top-up requests
Job ads copied city by city and language by language
Pay-to-work deposits and application fees

Explore threat intelligence →

One script, many fake HR botsExample

Posing asSolstice Pay HR Team

Bot
@solsticepay_hr_bot"Earn $45 an hour testing our app"
Removed
Bot
@solsticepayjob4_botSame script, new number
Removed
Bot
@solsticepayjob5_botSame script, new number
Removed
Ad
Solstice Pay remote app testerscrewjobs-hub.net
Reported

64%posed as HR, recruiters or job offers

43%were automated bots

1campaign view, pursued together

Use case

How teams use Unphish to stop executive impersonation.

Fake leaders and recruiters land on several desks at once. Unphish finds the profiles, numbers, bots and job ads using your people's names, proves they're fake and gets them removed, including the proof of identity platforms ask for.

See Executive Impersonation Protection →Book a demo

Security

Fake leaders spotted before staff are asked to act.

We watch social, messaging apps and lookalike domains for your leaders' names and photos.

Finance

No payments made on a fake request.

We remove the fake profiles and numbers asking for transfers, gift cards and bank changes.

People and talent

Candidates who reach the real careers team.

We take down fake recruiters, HR bots and job ads using your employer brand.

Executive office and comms

Leaders' names kept off scams.

We remove fake endorsements, profiles and investment channels using their faces.

In practice

A fake "CEO" starts messaging your finance team on WhatsApp.

What Unphish doesWhat your team sees

01
Spotted
A new WhatsApp account using the CEO's name and photo, and a matching social profile, are picked up and scored.
Sees an alert in the Threat Feed.
02
Checked
An analyst confirms they aren't the CEO's and captures screenshots, numbers and profile links.
Gets the evidence pack and approves enforcement in one click.
03
Taken down
Impersonation reports go to each platform, with proof of identity handled, and are escalated until removed.
Follows live status in the Enforcement Centre. No forms to fill in.
04
Linked
Accounts using the same photo, number or script are grouped into one campaign and removed together.
Follows the whole campaign behind the accounts.
05
Reported
Removal is verified and new profiles using the leader's name are watched for.
Gets reporting for security, finance and leadership.

Case study · Airline group

100%

of the fake cabin crew job ads using the airline's name were confirmed taken down between January and June 2026.

The ads copied real roles in cities across Australia, New Zealand and Asia, some aimed at speakers of specific languages, to collect applicants' details and fees.

See Executive Impersonation Protection →

94%

Removed within a dayOf being reported, so fewer applicants found them.

31%

Targeted language speakersAds for Hindi, Japanese, Italian, Spanish and French speakers made them look like real, specific roles.

Site behind almost all of themLinked together and pursued as one campaign.

Client name withheld to protect confidentiality.

Jargon, decoded

The executive impersonation terms worth knowing.

The words security, finance and HR teams use, in plain English.

CEO fraud: A fake message from a company leader asking staff to pay, buy or share something urgently.
Whaling: Phishing aimed at senior leaders, or pretending to be one, because their word moves money.
Business email compromise: Using a fake or hijacked business email to trick staff into paying or changing details.
Payment redirection: Getting a company to send a real payment to the scammer's account by "updating" bank details.
Fake recruiter: An account posing as a company's HR or talent team to reach job seekers.
Task scam: A fake job that pays small amounts for simple tasks, then asks workers to pay in to keep earning.
Fake endorsement: An ad or article that puts a real leader's name or face on an investment or product.
Proof of identity: Evidence platforms may ask for to confirm the real person before removing an impersonator.

Warning signs

How to spot a fake executive or recruiter.

A real-looking example

Jane Lee, CEO+61 412 000 218 · new number1"In meetings all day, can't talk"2

Following up my email from j.lee@solstice-pay.co3

Sam, please keep this between us for now.4

I need 5 x $200 gift cards for a client, codes by 11am.5

No need to go through approvals, I'll sign it off later.6

1
A new number or accountThe name and photo look right, but it isn't the number you have saved.
2
They can't be calledToo busy to talk means you can't check it's really them.
3
An email that's nearly rightOne letter, hyphen or ending away from your real domain.
4
SecrecyKeeping it quiet stops you asking a colleague, who'd spot it.
5
Gift cards or transfersFast, hard to trace and almost impossible to get back.
6
Skipping the usual checksReal leaders don't ask staff to bypass approvals.

Checklist for your team

Someone impersonating your leaders? Here's what to do.

Fake leaders move fast and switch accounts once they're spotted, so the first few steps matter most.

0 of 5 done

Tap each step to tick it off.

If money or data was lost, report it

ReportCyber ↗Scamwatch ↗IDCARE ↗

Want us to handle it? Request a takedown →

For your staff and suppliers

Give your people a head start.

Two short notes you can adapt for your intranet, onboarding, supplier emails or careers page. One helps people check a request from a leader. The other tells them what to do if they've already acted on one.

The copied version leaves blanks for your company name and official details.

Solstice PayStaff and supplier notice

How to check a request from a Solstice Pay leader

Our leaders won't message you from a new number or personal account to ask for payments.
We never pay with or ask for gift cards, codes or crypto.
Bank detail changes are always confirmed by phone on a number we already have.
We only recruit through solsticepay.com/careers and never charge fees to apply.
Not sure? Check with the person on a number you already know, or ask your manager.

Seen a fake? Report it at solsticepay.com/report

Example

Solstice PaySecurity team

Acted on a fake request?

Stop and don't reply or send anything else.
Tell your manager and the security team straight away.
Call the bank now if money was sent, to try to stop or recall it.
Change your password if you shared it or clicked a link.
Keep the messages, numbers and links for the report.

Reporting quickly helps us stop it reaching anyone else.

Example

How Unphish stops it

Get the fakes taken down.

Unphish finds the profiles, numbers, bots and job ads using your leaders' and staff's names, proves they're fake and gets them removed, including the proof of identity platforms ask for. Then we keep watching for the next one.

Every case checked by an analyst before a report is sent
Proof of identity and authorisation handled for you
Accounts from the same campaign found and removed together

See executive impersonation protection →

Case · Fake CEO on WhatsAppExample

Jane Lee, CEOWhatsApp · +61 412 000 218

Profile photo copied from LinkedIn

Sent to the finance teamAre you free? Need 5 gift cards before the board call. Keep this between us.

Removed

DetectedNew account using the CEO's name and photo
Evidence capturedProfile, number and messages sent to staff
Confirmed by an analystImpersonation asking staff for gift cards
Reported with proof of identityEvidence-backed impersonation report
Linked accounts foundSame photo on two more numbers, reported too
Removed and watchedRemoval verified, new profiles monitored

FAQ

Executive impersonation questions, answered.

What is executive impersonation?

Executive impersonation is when someone pretends to be a company's leaders, staff or recruiters to get money, data or access. It includes fake messages from a CEO, fake executive profiles, lookalike email addresses, fake recruiters and job ads, and fake endorsements using a leader's name or face.

What's the difference between CEO fraud, whaling and executive impersonation?

They overlap. CEO fraud usually means a fake message from a leader asking staff to pay or share something. Whaling targets senior people directly, or pretends to be them. Executive impersonation is the wider term and also covers fake profiles, fake recruiters and fake endorsements that use a leader's name in public.

Who do fake executives target?

Mostly people who'd normally do what a leader asks: finance and payroll teams, executive assistants, new starters and suppliers. Fake recruiters target job seekers, and fake endorsements and investment channels target customers and the public.

How can staff tell if a message from a leader is real?

Check it through a channel you already trust, like the leader's known number, the company directory or in person. Be wary of new numbers, requests for secrecy, gift cards, urgent transfers, changed bank details and anything that skips the usual approvals.

Can fake executive profiles and recruiter accounts be removed?

Yes. Platforms and messaging apps remove impersonation accounts when they're given evidence, and fake job ads can be removed from the sites hosting them. How long it takes depends on the platform and the case. Every executive, staff and recruiter impersonation we pursued in the first half of 2026 was confirmed taken down.

What should we do if someone is impersonating one of our executives?

Tell staff straight away which channels are real, capture screenshots and links, and report the accounts as impersonation, or request a takedown and our team will check them and handle the reports. Platforms may ask for proof of identity from the person being impersonated, and we can help with that.

How can organisations reduce executive impersonation?

Agree a verification step for payments and sensitive requests, tell staff and suppliers how leaders really contact them, publish where you recruit, and watch social platforms, messaging apps, job sites and lookalike domains for leaders' names so fakes can be removed quickly.

By industry

Executive impersonation in your industry.

Every sector gets copied in its own way. See the fake leaders, recruiters and staff we find and take down in yours.

Banking and Financial Services

Fake executive endorsements and payment requests.

Fintech

Fake founder profiles and investment pitches.

Crypto

Fake CEO channels and token giveaways.

Retail and E-Commerce

Fake recruiters and supplier payment requests.

Airline and Transport

Fake cabin crew job ads and recruiters.

Lottery and Gambling

Fake VIP hosts and HR bots.

Public Sector and Government

Fake officials and minister endorsements.

Non-Profit Organisations

Fake directors asking for donations.

Film and Entertainment

Fake talent, casting calls and celebrity profiles.

Keep exploring

SolutionExecutive Impersonation ProtectionFake leaders, recruiters and staff, removed → SolutionSocial Media ProtectionFake accounts and impersonators → SolutionDomain ProtectionLookalike email domains, caught early → Use caseBrand abuseFake accounts, shops and domains using your name →

Try it

Real or fake?

Five messages that say they're from Solstice Pay, our example company, and its CEO Jane Lee. Its domain is solsticepay.com and it recruits at solsticepay.com/careers. Which would you trust?

The quickest check: contact the person on a number or channel you already have. A real leader won't mind you checking.

How we take them down →

Found someone impersonating your leaders?

Send us the link and our team will check it and talk you through taking it down. Or book a demo to see how we find them first.

Book a demo Request a takedown