I85PREP
⌘ K
ICDL Cyber Security study materials
ICDL Cyber Security study resources

ICDL Cyber Security (ICDL): The Urgent Invoice From the CEO

ICDL Cyber Security · Put your knowledge to work in context.

All case studies

The Urgent Invoice From the CEO

Tom is a junior accounts clerk at a 25-person marketing agency. At 16:40 on a Friday he receives an email that appears to come from the CEO's name. It says the CEO is in a meeting, cannot take calls, and needs Tom to pay a supplier invoice of €18,400 today or 'we lose the contract'. The email domain is agency-mail.com instead of the real agency.com. The invoice PDF has a bank account in a different country. The CEO's real calendar shows she is at an offsite and her phone is on silent. Tom has authority to release payments under €20,000.

1. Identify the indicators that this is a fraudulent request and explain what type of attack it is.

Read the worked answer

This is business email compromise (BEC) / CEO fraud - a social-engineering attack, not a technical exploit.

Indicators:

  • Lookalike domain (agency-mail.com vs agency.com) - classic spoofing.
  • Urgency and secrecy: 'cannot take calls', 'today or we lose the contract'.
  • Pressure to bypass normal process by targeting someone with payment authority just under their limit.
  • Changed bank details to a foreign account, with no prior notice.
  • Timing: late Friday, when verification is hardest.

Each indicator alone is weak; together they form a strong pattern.

2. Tom wants to 'just call the CEO to check'. Explain why that is right in principle but needs care, and describe the correct process.

Read the worked answer

Calling is the right instinct - verify through a separate, known channel, never by replying to the email.

But care is needed:

  • Use a number from the internal directory, not one in the email signature.
  • If the CEO is unreachable, do not proceed; escalate to a second approver or hold the payment.
  • Do not confirm details to the caller until identity is established.

Correct process:

  1. Pause the payment - urgency is the attacker's tool.
  2. Verify the request out-of-band with a known contact.
  3. Confirm bank details with the supplier through an independently sourced number.
  4. Report the email to IT/security so others are warned.
  5. Follow the dual-authorisation rule for any change of bank details.