The Better Business Bureau has warned the public about "boss scams," a phishing and smishing pattern in which attackers impersonate a senior executive or manager by email or text to pressure employees into sending money, gift cards, or sensitive information. IdentityIQ has summarized how these scams work, the warning signs, and the steps employees should take when something feels off.
How a boss scam works
- Attackers compromise or spoof a senior executive's email account.
- They send an email or text to a subordinate, often in finance or HR, framed as urgent, confidential, and time-sensitive.
- The message asks for a wire transfer, gift card purchase, or sensitive employee data, with the implicit or explicit instruction not to verify with anyone else.
- The subordinate complies, because the request appears to come from a person of authority and the urgency discourages second-guessing.
Warning signs
- A request that comes "only via email" or "only via text" from a senior who normally talks in person or by phone.
- Pressure to keep the request confidential or to bypass normal procedures.
- A change in payment instructions, especially to a new account or a new vendor.
- A request for gift cards, which legitimate businesses almost never ask employees to purchase.
- Subtle email address changes, such as a different domain or a display name that does not match the underlying address.
What to do
- Verify the request through a known channel, such as a phone call to a number already in your contacts, not one supplied in the message.
- Slow down. Urgency is the attacker's main weapon; a five-minute pause to verify is usually enough to break the attack.
- Check the email address carefully, including the domain. Look-alike domains are a common giveaway.
- Report the message to IT or security, even if you did not click or comply. Reporting helps tune the filters and warn other employees.
- If you did comply, contact IT and finance immediately. The faster the report, the better the chance of recovering funds.
Where to report
| Internal first | External options |
|---|---|
| IT or security team | FBI Internet Crime Complaint Center (IC3) |
| Federal Trade Commission (FTC) | |
| Better Business Bureau Scam Tracker | |
| Credit bureaus (if personal data was exposed) |
Who should care
Finance and accounting staff:** Primary targets for money-transfer requests.
HR personnel:** Often targeted for employee data or payroll information.
Executive assistants:** Gatekeepers who attackers try to route around.
Small businesses:** Often lack the dual-approval controls that larger organizations have in place.
Anyone who approves expenses:** Boss scams assume you will follow orders without questioning.
Our analysis
Boss scams exploit organizational hierarchy, not technology. The email is the delivery mechanism, but the social engineering is the real attack. The mitigation is therefore cultural, not purely technical.
Organizations where verifying a wire transfer by phone—even with the CFO—is normal practice are far harder to attack than those where questioning the boss feels risky. Training must reinforce that verification is a professional behavior, not insubordination. The trade-off is speed: verification adds a step that slows down legitimate requests. But that friction is the point—it's exactly what stops attackers.
The other trade-off is embarrassment. Employees who fall for these scams often hesitate to report because they feel foolish. Security culture must make reporting frictionless and blame-free, because the window to recover funds is narrow.
What to watch next
- Whether AI-generated voice and video deepfakes expand the boss scam playbook beyond email and text.
- Whether organizations adopt mandatory voice verification for financial requests as a standard practice.
- Vendor risk programs that include business email compromise scenarios in employee training.
Slow down. Verify. The five-minute pause is the defense.
Key takeaways
- Boss scams exploit hierarchy, not technology; cultural verification is the defense.
- Urgency is the attacker's main weapon; pausing to verify breaks most attacks.
- Reporting matters, even when nothing was clicked or complied with.
- Gift card requests from executives are a reliable red flag—legitimate businesses almost never make them.
Frequently asked questions
What is a boss scam?
A phishing or smishing attack in which the attacker impersonates a senior executive to pressure an employee into sending money or sensitive data.
Where do I report a boss scam?
Internally to IT, and externally to the FBI IC3, the FTC, the BBB Scam Tracker, and the credit bureaus if personal data was exposed.
What is the most important thing an employee can do?
Verify the request through a known channel—not one supplied in the message. A five-minute pause to confirm by phone is often enough to break the attack.
What is the biggest warning sign?
A request for gift cards, a demand for secrecy, or a message that creates artificial urgency. Legitimate executives do not ask employees to bypass normal procedures.
Can these scams be stopped with better email filters?
Partially. Filters catch many spoofed emails, but they cannot stop a message sent from a legitimately compromised account. Human verification is the necessary backup.