Menu
Breach Value Calculator

Social Engineering Aimed at Executives: Lessons From the Nvidia News

How criminals target senior executives with pretexting, fake profiles and impersonation, why company news opens a window, and what to put in place.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

Published Updated on 11 min read

AI-generated illustration: Social Engineering Aimed at Executives: Lessons From the Nvidia News
AI-generated illustration

Social engineering aimed at executives works because senior people hold authority, money and access, and because so much about them is public. The defence is not a sharper eye. It is a set of habits: verify any "CEO" request on a second channel, shrink the executive's public footprint, treat unsolicited approaches with care, and have an impersonation plan ready before the company is in the news.

Social engineering means manipulating a person, rather than a computer, into giving up access, information or money. When the target is a chief executive, or someone who acts on the chief executive's word, the payoff is larger and the pretext is easier to build.

Why are executives the attack surface?

Three things make senior leaders worth an attacker's patience.

  1. Authority. A request that appears to come from the CEO is less likely to be questioned, and the person receiving it may feel pressure to act quickly.
  2. Access. Executives approve payments, see deal documents and can override process. Their assistants and finance teams can too.
  3. Visibility. Keynotes, interviews, earnings calls and social posts give anyone hours of voice, video and writing style to study, plus a public diary of where the executive will be next.

The same openness that helps a leader build a company gives an impersonator raw material. That is not a reason to hide leaders. It is a reason to assume their identity will be borrowed, and to plan for it.

What has Nvidia's board confirmed?

On 8 November 2026, Nvidia's board said it is initiating an independent investigation, overseen by a committee of independent directors assisted by outside independent counsel. In the same statement from the Nvidia board, the board said its chief executive fully supports the review and has committed to cooperating with it, and that it has confidence in him and his leadership team.

We have seen no primary source reporting a scam linked to the Nvidia news. The lesson here is a general one, not a claim about this case: a company in the news is a natural target for impersonation.

Attention is high, and staff, customers and investors may expect unusual messages. A fake "statement from the CEO", a fake internal memo or a cloned voice can be harder to spot when the real situation is already unusual.

How does social engineering target executives?

Common approaches fall into four patterns. None of them needs advanced hacking.

Pattern What it looks like First control
Pretexting An invented but plausible story: a lawyer, journalist or auditor with an urgent need Confirm who they are through a contact you find yourself
Impersonating the executive A "CEO" message to finance or an assistant asking for money, files or access Out-of-band call-back before acting
Long-game relationship Weeks of friendly contact from a new connection before any ask Treat new profiles as unverified; report odd approaches
Approaches while travelling Introductions, invitations and gifts at events Pre-trip briefing; no unknown devices or cables

Pretexting

A pretext is an invented story that makes a request seem normal: a lawyer handling a confidential acquisition, a journalist checking a quote, an auditor who needs a document today. The story may borrow real names and real events from public sources so it survives a first check.

Impersonating the executive

Here the executive is not the target but the costume. Someone pretending to be the CEO writes to finance, the executive assistant or a regional manager and asks for a payment, a gift-card purchase, a file or a password reset. The request often comes with a reason to skip normal process: secrecy, a deadline, travel.

The FBI documented a version of this aimed at government. Since April 2025, it said in PSA I-051525-PSA, malicious actors had impersonated senior US officials using text messages and AI-generated voice messages to build rapport, then sent links under the guise of moving the conversation to a separate messaging platform. The same pattern fits any organisation with a well-known leader.

The long-game relationship

Some approaches take weeks. A recruiter, investor, researcher or peer makes contact on a professional network, shares useful material, suggests a call, then a meeting at a conference. Only later does the ask arrive: a document, an introduction, a "quick look" at a file. Each step feels small.

A fake profile is a common way to start. The UK government launched a free Think Before You Link app in May 2022 to help people spot fake profiles and report or remove them (figures in the section for security teams below).

Approaches while travelling

Conferences, trade delegations and hotel lobbies make introductions normal and checking hard. A friendly contact, a shared taxi, an invitation to a side meeting or a gift of a USB stick or a charger can all start a relationship or an intrusion. Busy schedules and unfamiliar networks lower the guard.

How do you protect your executives?

These five controls suit any company whose leaders are visible. Most cost time, not money.

1. Verify every "CEO" request out-of-band

Out-of-band means on a separate channel you already trust, not one the request supplied. If a message from the chief executive asks for money, data, credentials or a change of process, the person receiving it calls back on a number from the company directory, or confirms in person, before acting.

The FBI's business email compromise guidance, PSA I-091124-PSA, puts it as using "secondary channels and/or two-factor authentication to verify requests for changes in account information." Write that rule down and tell staff the CEO wants them to follow it, even when the CEO is the one asking. Deepfake voice and video calls need the same habit; our guide to spotting deepfake scams covers the call-back for those channels.

2. Review the executive's digital footprint

Once or twice a year, look at the leader the way an outsider would. What can anyone find about:

  • personal email addresses and phone numbers
  • family members, home area and daily routine
  • travel plans, conference schedules and speaking slots
  • the names of their assistant, chief of staff and finance contacts
  • writing style, sign-offs and nicknames used in public posts

Remove what has no business purpose, and ask data brokers and people-search sites to delete what they hold where the law allows. Keep the public diary vague until after an event.

3. Prepare for travel and conference approaches

Before a trip, brief the executive and anyone travelling with them:

  • Treat unsolicited introductions, invitations and gifts as unverified until checked with the host or your own team.
  • Use a travel device with only what the trip needs, and keep it in your possession.
  • Do not plug in chargers, cables or USB drives from others.
  • Report any approach that felt odd, even if nothing happened. One report can join up a pattern.

4. Write a crisis-time impersonation plan

Do this before the company is in the news. The plan should say:

  • Which channels are official. Publish where real statements appear, and say what the company will never do (for example, ask for payments or crypto through social media).
  • Who watches. Someone monitors for fake accounts, fake statements and synthetic video of leaders, and keeps a log.
  • Who reports and takes down. A named person files impersonation reports with each platform and, where fraud is attempted, with the police or the FBI IC3.
  • How leaders give urgent instructions. A pre-agreed verification step, such as a call-back or a code word, for anything that bypasses normal approval.
  • Who speaks. One spokesperson, so staff know a message from anyone else is suspect.

5. Brief staff when the company is in the news

When the company or a leader is in the headlines, send a short note to all staff within a day. Say three things: expect fake messages that use the news, no leader will ask you to skip a payment or security process, and here is where to report anything odd.

Thank people who report. A rise in reports during a news cycle is the plan working, not noise.

This is one part of a wider picture. Staff with legitimate access who are pressured or recruited are a separate risk, handled by an insider threat program. The email and messaging side, from passkeys to DMARC, sits in our AI phishing protection plan.

Going deeper: for security and IT teams

Threat model. The attacker needs three things: a credible identity to borrow (the executive), a target who can act (finance, the executive assistant, IT support, a regional lead), and a channel the target trusts. What they get ranges from a wire transfer to mailbox access to a confidential file. Senior people are both targets and costumes, and the controls differ. For the executive as target, you reduce exposure and harden their accounts. For the executive as costume, you harden the people who act on their word.

How the chain ran in one documented campaign. The FBI's May 2025 alert describes it in order: a first contact by text message or AI-generated voice message, rapport, then a malicious link sent under the guise of moving to a separate messaging platform, followed by access to personal accounts, which can then be used to target the person's contacts (I-051525-PSA). The channel shift is the step your controls can see. A request to "continue on another app" or to "use my personal number" is a signal in its own right.

In practice: what BEC costs. The FBI's September 2024 alert counted 305,033 domestic and international business email compromise incidents from October 2013 to December 2023, with an exposed dollar loss of $55.5 billion. In the US alone, 158,436 victims reported an exposed loss of $20.1 billion (I-091124-PSA). The FBI defines BEC as a scam targeting businesses and individuals "who perform legitimate transfer-of-funds requests", carried out through social engineering or computer intrusion. These figures cover all business email compromise, not executive impersonation alone, but the people who handle payments are often the same people who receive executive instructions.

In practice: fake profiles at scale. The UK government's May 2022 announcement of the Think Before You Link app said LinkedIn "stopped 11.6m fake accounts at registration" in the first half of 2021 (gov.uk). That is a 2021 figure, not a current one. Treat the profile behind a new approach as unverified until you have checked it through a channel you control.

Controls with specifics.

  • Payment and change control. Any new payee, bank-detail change or out-of-cycle payment above a set threshold needs a call-back to a number on file and a second approver. No exception path for executives; an exception path is what impersonators ask for.
  • Executive account hardening. Phishing-resistant MFA for executives, assistants with delegated mailbox access, and finance approvers. Review mailbox delegation and calendar sharing quarterly, because a compromised assistant account is as good as the executive's.
  • Impersonation protection in mail. Check whether your email security product supports display-name and look-alike-domain impersonation protection for a named list of users, and add the executive team, the board and finance leads. Tag external mail clearly, so "CEO" from an outside domain stands out.
  • Look-alike domain monitoring. Watch new registrations that resemble your domain and your executives' names, and set a takedown route with your registrar or a brand-protection provider.
  • Social impersonation. Verify official executive accounts where platforms allow it, and record the impersonation-report process for each platform in the crisis plan.

Detection and evidence.

  • External messages using an executive's display name, or internal messages from an executive sent at unusual hours or from unusual locations.
  • New inbox forwarding or hiding rules on executive, assistant and finance mailboxes.
  • Requests to move the conversation to a separate messaging platform, which the FBI describes as part of the pattern.
  • Payment-change requests within days of news coverage of the company. Correlate report volumes with your news calendar.
  • Test it: run an announced exercise where a "CEO" asks finance for an urgent transfer by text, and measure whether the call-back happens. Report the result to the board as a control test, not a staff failure.

What to ask. Who in finance can release a payment on one person's instruction? Which executive mailboxes have delegates, and do those delegates use phishing-resistant MFA? How long would it take to get a fake executive account removed from each platform we care about? Does the crisis communications plan name the person who confirms or denies a statement attributed to the CEO?

What we could not verify. The UK NPSA's Think Before You Link materials and the MITRE ATT&CK pages did not load for us during research, so this post does not quote them or cite technique IDs from them.

Checklist: protecting executives this quarter

  1. Write the out-of-band verification rule for any request that claims to come from a leader, and have the CEO announce it.
  2. Require a second approver and a call-back for payment and bank-detail changes, with no executive exception.
  3. Put phishing-resistant MFA on executive, assistant and finance accounts.
  4. Run a footprint review of each executive and remove what has no business purpose.
  5. Brief every travelling executive on approaches, gifts and devices.
  6. Write the crisis-time impersonation plan: official channels, monitoring, takedowns, verification step, spokesperson.
  7. Prepare a two-paragraph staff note to send the day the company is in the news.
  8. Test one control with an announced exercise and report the result.

Key takeaways

  • Executives are targeted because of their authority, access and visibility, and impersonated for the same reasons.
  • Common patterns are pretexting, impersonating the executive, long-game relationships through fake profiles, and approaches while travelling.
  • A company in the news is a natural target for impersonation. Plan for that before it happens.
  • Verify any "CEO" request on a channel you already trust; the FBI's BEC guidance asks for secondary-channel verification.
  • The FBI counted an exposed loss of $55.5 billion across all business email compromise between October 2013 and December 2023, not only scams that impersonate executives.
  • For IT teams: harden the people who act on an executive's word, watch for channel-shift requests, and test the call-back control.

Sources

Spotted a mistake? Report a correction.