For years, the advice for spotting a fraudulent email was relatively straightforward: watch for spelling mistakes, awkward wording, suspicious email addresses, and requests that seem out of the ordinary.
Those warning signs are still useful. But they are no longer enough.
In September 2026, Microsoft Security Research published a detailed analysis of a large-scale financial fraud campaign that illustrates this new reality. More than one million fraudulent emails were sent as part of an operation in which cybercriminals impersonated company executives, among others. Their goal: convince accounts payable employees to process payments of nearly US$50,000.
The scale of the attack was not the only concern. The messages combined executive impersonation, fake invoices, fabricated email threads, and customized information to build a convincing story.
Microsoft also identified several indicators consistent with the use of generative AI in the creation of email templates. The company remains cautious, however: these indicators suggest AI involvement but do not, on their own, establish exactly how much of the campaign content was generated using AI.
Welcome to the new generation of CEO fraud.
CEO fraud isn’t new. What’s changing is how convincing it can be
CEO fraud, often associated with Business Email Compromise (BEC), relies on a surprisingly simple principle: exploiting trust and authority.
An employee receives a request that appears to come from the CEO, CFO, or another executive. An invoice needs to be paid quickly, a wire transfer must be processed, or a supplier’s banking information needs to be updated.
The attacker does not necessarily need to compromise the executive’s account. They may use a lookalike email address, manipulate the sender’s display name, or imitate company communications well enough to create the illusion of legitimacy.
What makes artificial intelligence particularly concerning is how easily that illusion can now be improved.
An attacker can quickly produce coherent professional communications, adapt templates, and personalize messages for different organizations.
In its analysis, Microsoft notes that the adoption of AI enables threat actors to improve campaign templates and create emails that are better tailored to their targets.
In other words, “this email looks poorly written” is becoming an increasingly unreliable defense.
A fake invoice doesn’t necessarily look fake anymore
The campaign observed by Microsoft provides a useful example of the level of preparation businesses should now expect.
The fraudsters did not simply send a message saying, “Pay this invoice.”
They built a scenario.
According to Microsoft’s analysis, the attackers combined several elements: executive impersonation, the branding of a known vendor, fabricated invoices, and fake email conversations. Some information was even customized to the organization being targeted.
In this campaign, the messages included a detailed invoice impersonating ServiceNow. Microsoft stated that it found no evidence that ServiceNow or the other legitimate organizations being impersonated had been compromised or were involved in the fraudulent activity.
Their identities were simply being used to make the story more believable.
The attackers also registered domains resembling those of legitimate organizations and created fake conversations between executives to provide additional context for the payment request.
This is an important distinction for SMBs: a message can look completely legitimate even when neither your CEO’s account nor your supplier’s account has been compromised.
The real problem: we still trust the content
Now imagine the situation inside a Canadian SMB.
It is 4:30 p.m. Someone in accounts payable receives an invoice accompanied by a message from the CEO. The supplier seems plausible, the amount is not unreasonable, and the invoice looks professional.
The message says the payment needs to be processed quickly.
What does the employee do?
In many organizations, security still depends heavily on that employee’s judgment.
That is precisely what needs to change.
The question should no longer simply be:
“Does this email look legitimate?”
It should become:
“Does our process allow this transaction to happen simply because an email looks legitimate?”
That distinction fundamentally changes how businesses should approach CEO fraud.
The best defense isn’t turning employees into detectives
Cybersecurity awareness remains essential. But asking employees to consistently distinguish a legitimate message from a fraudulent one becomes increasingly difficult when attackers have tools that can improve the quality and personalization of their communications.
Businesses therefore need safeguards that do not depend entirely on an employee’s ability to spot the fraud.
For example, a request to change a supplier’s banking information should automatically trigger verification through an independent channel.
And “independent” is the important word.
Do not call the phone number provided in the suspicious email. The employee should use contact information already on file or speak with a known contact at the supplier.
High-value transactions can also require a second approval. An unusual request supposedly coming from an executive can be confirmed by phone or through another communication channel established in advance.
The goal is not to slow down every transaction.
It is to determine which actions carry enough risk to justify a few additional minutes of verification.
Email security can help, but it cannot replace good processes
Internal procedures are an essential line of defense, but they should not work alone. Email security also needs to evolve to address attacks that no longer depend on an infected attachment or an obviously malicious link.
Modern email security solutions can analyze more than the raw content of a message. Depending on the technology being used, they may detect impersonation attempts, domains designed to resemble legitimate businesses, anomalies in communication patterns, or messages displaying characteristics associated with financial fraud.
This contextual analysis is particularly important in CEO fraud. An email may contain no malware, no dangerous attachment, and not even a link. The message itself is the attack.
Email authentication also remains important. Mechanisms such as SPF, DKIM, and DMARC, when properly configured, can help prevent certain forms of domain spoofing and help mail systems determine whether a message is authorized to be sent on behalf of an organization.
But even excellent email security cannot eliminate every opportunity for fraud.
An attacker can register a new domain that closely resembles yours, compromise a third party’s account, or simply create a scenario convincing enough to avoid triggering detection mechanisms.
That is why cybersecurity and administrative controls need to complement each other.
Technology should try to stop the fraudulent email. Your processes should stop the fraud from succeeding if the email gets through anyway.
This layered approach also helps ensure that the entire burden of security does not fall on the employee who happens to receive the message.
Three questions every SMB should ask this week
You do not need to launch a six-month cybersecurity project to start reducing this risk.
Instead, bring together your finance, management, and IT teams and ask three questions:
- What do we do when a supplier asks us to change its banking information?
- At what amount does a transaction require a second approval?
- How can an employee verify an unusual request from an executive without relying on the contact information contained in the message they received?
If the answers vary depending on who you ask, your problem may not be technological.
You probably have a process problem.
And that is exactly what fraudsters are looking for: an environment where urgency, authority, and a convincing message are enough to bypass normal controls.
With AI, the line of defense needs to move
Artificial intelligence did not invent CEO fraud.
It can, however, help fraudsters improve their templates and create campaigns that are better adapted to the people they target.
The answer is not to ask employees to become even better at guessing whether an email is authentic.
It is to build processes in which a fraudulent request can look completely legitimate and still fail.
That may be the most important change in perspective.
If you recognize weaknesses in your procedures or email security, the specialists at Mon Technicien can help you get a clearer picture. Our team helps SMBs strengthen their cybersecurity, protect their communications, and improve internal practices to reduce risk before a simple email turns into a costly mistake.
in your taskbar.