TL;DR: Microsoft reported a campaign of more than a million emails, sent between August 3 and 5, 2026, that impersonated chief executives and urged accounts payable teams to send ACH payments for a supposed ServiceNow annual subscription. It appears to use generative AI and mostly hit enterprise users in the U.S. Payment changes must be confirmed by a call to a known number.
👉 Use the free digital footprint checker — 30 seconds →
Business email fraud is old, but The Hacker News (September 13, 2026) summarised Microsoft's research showing how it is scaling up. Attackers register lookalike domains, send executive-themed payment requests through trusted email infrastructure, and attach fabricated invoices and fake conversations to look real.
The campaign in brief
- More than a million scam emails between August 3 and 5, 2026.
- Messages pretended to come from CEOs and asked finance staff to start ACH transfers for a supposed ServiceNow subscription.
- Microsoft's evidence suggests generative AI was used to draft templates tailored to recipients.
- Targets were mainly enterprise users in the U.S., including IT services, consumer goods, real estate and manufacturing.
Why small companies should care
The technique does not depend on company size. A short, confident email from someone who appears to be the boss, with an invoice attached, is enough. Similar patterns show up in personal cases, such as the one-extra-letter email that nearly cost a buyer AU$1.2 million.
Controls that stop it
- Require a callback to a known number for any new payee or changed bank detail, even when the request appears to come from a senior executive.
- Use two-person approval for ACH and wire transfers.
- Check the sender's full domain, not the display name.
- Have a plan for recall. Speed matters, as explained in wire recall and wire fraud recovery in the US.
Impersonation of a trusted contact is also the hook in fake farm equipment seller scams and the passkey phishing fake IT calls.
FAQs
What is CEO fraud?
It is a scam in which criminals impersonate a senior executive to convince finance staff to send a payment or change bank details.
How can a small business protect itself from CEO fraud?
Require a callback to a known number for any new payee or changed bank detail, use two-person approval, and verify sender domains.
What should I do if an ACH payment has already been sent?
Contact your bank immediately to request a recall and report the incident to law enforcement. Speed improves the chance of recovery.
Want to know how exposed you are right now? Run the free digital footprint checker.
Curious what's already out there? Scan My Shadow checks a phone number and email across 1,500+ sources and sends a clear report — no guesswork, just facts. Start your scan.