An urgent message lands in your inbox from a senior executive. They need you to make a payment, purchase something or provide sensitive information, and they need it done immediately. The name looks familiar, the request sounds important and questioning your boss may feel uncomfortable. But could this be a fraudulent email? Is the person contacting you really who they say they are?
Impersonation and phishing scams are becoming increasingly sophisticated. The National Cyber Security Centre (NCSC) warns that criminals frequently pretend to be people or organisations their targets trust, while modern scams can be convincing enough to fool even experienced users.
A recent incident involving Prime Minister Andy Burnham demonstrates how easily impersonation attempts can reach people in positions of significant responsibility. For employers and HR professionals, it provides an opportunity to consider whether employees would recognise a fraudulent email or message supposedly sent by their boss, and whether they would feel confident challenging an unusual request.
What Happened in the Andy Burnham Impersonation Scam?
Andy Burnham exchanged several messages with an individual pretending to be White House Chief of Staff, Susie Wiles. Burnham subsequently became suspicious about the contact and reported it, with reports indicating that nothing of consequence was disclosed during the brief exchange.
The incident demonstrates an important feature of impersonation fraud: criminals do not necessarily need to impersonate a bank or an unfamiliar organisation. Pretending to be a recognisable colleague, senior executive or trusted professional contact can make a request appear considerably more credible.
READ: Employee Fraud Prevention: Lessons From the £600K Fraud Case
In a workplace setting, this can become what is commonly described as CEO fraud or business email compromise. A fraudster may impersonate a chief executive, director or another senior employee and contact someone who has the ability to make payments, access confidential information or complete purchases.
Like what you're reading? Don't forget to subscribe to our bi-weekly newsletter!
The apparent authority of the sender is part of what makes these scams effective. An employee may be much less likely to question an urgent instruction if they believe it has come directly from the chief executive.
What Does CEO Fraud Look Like?
CEO fraud can begin with a surprisingly ordinary message. An employee might receive what appears to be an email or text from a senior manager asking whether they are available to complete an urgent task. Once the employee responds, the fraudster may request a bank transfer, confidential information, gift cards or another transaction.
Other scams may involve fake invoices or requests to change payment details. The criminal’s objective is to make the instruction appear sufficiently credible that an employee acts before checking whether the request is genuine.
Phishing works on a similar principle. The NCSC describes phishing as the use of a fraudulent email, text or call designed to trick victims, often with the aim of stealing passwords, banking details or other sensitive information, or directing them to malicious websites.
These attacks can also be highly targeted. Information published on company websites, professional networking platforms and social media can help criminals identify senior employees, reporting structures and new starters. That information can then be used to make a fraudulent email significantly more convincing.
How Can Employees Tell Whether It Is Really Their Boss?
Employees should be particularly cautious when a message combines authority with urgency. The NCSC identifies authority and urgency as two common characteristics of scam communications. Criminals may impersonate an important person and create a limited timeframe specifically to pressure the recipient into acting before they have had an opportunity to think.
A request that seems unusual should therefore receive additional scrutiny, even when the sender’s name appears familiar. Employees should examine the actual email address rather than relying solely on the display name. A fraudulent address may contain an additional letter, a different domain or a subtle spelling change designed to resemble the genuine company address.
Unexpected changes in communication style can also provide clues. An employee who normally receives detailed instructions from their manager should question a sudden vague message demanding an immediate financial transaction.
Requests for secrecy should attract particular attention. A supposed senior executive who says they are in a meeting, cannot speak on the phone and needs an employee to complete a confidential transaction immediately may be attempting to prevent independent verification.
However, employers should avoid teaching employees that a fraudulent email is always poorly written or visually obvious. The NCSC warns that scams are becoming smarter and that traditional warning signs such as poor spelling and grammar are no longer reliable on their own.
Verify Unusual Requests Through Another Channel
Perhaps the most important principle is simple: employees should be allowed to check. If an employee receives an unusual financial or confidential request apparently from their manager, they should verify it independently. This might involve calling the manager using a known telephone number, speaking to them in person or starting a separate conversation through an established company communication channel.
Employees should not rely on contact information contained within the suspicious message itself. NCSC guidance recommends contacting an organisation directly using independently obtained details rather than telephone numbers or addresses contained in a questionable communication.
This is particularly important where an email requests an urgent payment, a change to supplier bank details or the disclosure of confidential employee or customer information.
Employers can support this approach by creating verification procedures for sensitive transactions. If employees know that unusual payment requests must always be independently confirmed, stopping to check becomes part of normal business procedure rather than an act of insubordination.
What Can HR Do to Prevent a Fraudulent Email Succeeding?
Cybersecurity may traditionally have been viewed as the responsibility of the IT department, but preventing impersonation fraud also involves people, processes and workplace culture. HR therefore has an important role to play.
Employee training should explain what phishing and CEO fraud actually look like in practice. Generic annual cybersecurity modules may have limited impact if employees cannot connect the information to situations they encounter in their own roles.
Training can instead use realistic scenarios. Employees might be shown an apparent email from a director requesting an urgent transfer and asked what they would do next. The NCSC itself provides an exercise designed to help organisations practise identifying and reporting suspected phishing emails.
READ: Skills for AI Are Becoming the New Baseline
Training should also be refreshed regularly. Fraud tactics evolve, and employees who completed phishing training several years ago may not be prepared for more convincing modern impersonation attempts.
New starters can be particularly important. They may not yet understand how senior managers communicate, which payment processes are normal or whether a particular request is unusual. Fraud awareness should therefore form part of induction rather than being postponed until the organisation’s next annual training cycle.
Create a Culture Where Employees Can Challenge the Boss
Technical controls cannot address one of the biggest vulnerabilities in CEO fraud: workplace hierarchy.
An employee may recognise that a message seems unusual but still comply because they are worried about questioning a senior colleague. If the message says the chief executive needs a payment made immediately, asking whether the chief executive is really making the request can feel uncomfortable.
Employers should actively remove that barrier. Employees should know that they will never be criticised for verifying an unusual financial or confidential request. Senior leaders can reinforce this by openly encouraging staff to challenge requests that do not appear consistent with normal procedures.
This approach protects the organisation without undermining legitimate management authority. In fact, a culture in which employees feel able to raise concerns can provide an important additional layer of protection when technical systems fail to identify a fraudulent email.
Strengthen Internal Processes
Training should operate alongside effective financial and cybersecurity controls. Organisations should consider whether one employee can authorise significant transactions without independent approval and whether changes to supplier payment details require separate verification. Requests involving unusual payments or sensitive information should trigger additional checks regardless of who appears to have sent them.
Access to confidential information should also be limited according to genuine business need. If a phishing attack compromises one employee’s account, appropriate access controls can help limit the amount of information available to the attacker.
HR should work alongside IT, finance and senior management to establish clear responsibilities. Employees need to know who to contact when something appears suspicious and what happens after they make a report.
The organisation’s procedures should make reporting quick and straightforward. A complicated reporting process can discourage employees from raising concerns, particularly when they are unsure whether a message is genuinely fraudulent.
What Should Employees Keep an Eye Out For?
Employees should become particularly cautious when an unexpected message asks them to act quickly, keep a request confidential, transfer money, purchase gift cards, change payment information, disclose passwords or provide sensitive personal or business data.
Unexpected attachments, unfamiliar links and subtle differences in email addresses can also indicate phishing. The NCSC advises people not to click links contained in suspicious emails and notes that criminals may use malicious websites to steal passwords or other personal information.
READ: Beyond Disciplinary Action at Work: Reducing Bullying, Rudeness and Absenteeism
Context matters too. Employees should ask themselves whether the request makes sense. Does their manager normally communicate this way? Why is the finance director suddenly asking them to make a payment outside the normal approval process? Why can the sender not discuss the request by telephone?
A message does not need to contain an obvious mistake to be fraudulent. Sometimes the strongest warning sign is simply that the request is unusual.
Reporting a Fraudulent Email
Employees should know exactly how reporting fraudulent emails works within their organisation. Suspicious work communications should normally be reported to the organisation’s IT or cybersecurity team in accordance with internal procedures.
Where an employee has already clicked a suspicious link or provided information using a work device, reporting the incident quickly becomes especially important. NCSC guidance specifically advises employees who encounter these situations on work laptops or phones to contact their IT department.
Suspicious emails can also be forwarded to the NCSC’s Suspicious Email Reporting Service. The NCSC states that reports help it investigate malicious activity and remove scam websites and email addresses. As of July 2026, it reported receiving more than 58 million scam reports, resulting in 256,000 scams being removed across 454,800 URLs.
Most importantly, employers should avoid creating a blame culture when an employee reports that they may have clicked something suspicious. Fear of disciplinary consequences can encourage people to conceal mistakes, potentially giving an attacker more time to cause damage. Rapid reporting should be encouraged, even when the employee is uncertain whether the message was fraudulent.
Fraudulent Email: Our Final Thoughts
The Andy Burnham impersonation incident demonstrates that even experienced and high-profile individuals can be targeted by convincing attempts to impersonate trusted contacts. For employers, the lesson is not that employees should distrust every message they receive, but that they should know when to stop and verify an unusual request.
A fraudulent email from the “boss” may use authority, urgency and familiarity to persuade an employee to transfer money or disclose valuable information. As phishing techniques become increasingly sophisticated, relying on employees to identify poor spelling or an obviously fake email address is no longer enough.
HR teams can help protect their organisations by providing realistic training, incorporating fraud awareness into induction, establishing straightforward reporting procedures and creating a workplace culture where questioning an unusual request from a senior colleague is encouraged rather than criticised.
Employees should understand that taking a moment to independently verify an unexpected instruction is not wasting time. In the case of CEO fraud, that simple check could prevent a much more costly mistake.
We hope you found this employment law update informative. At the Employment Law Review, we provide regular updates on significant developments in the field. So, to stay informed, subscribe to our newsletter today!