Part of our Scam Spotlight series — plain-language breakdowns of specific phishing and scam patterns we see, building on our Understanding Spam and Phishing Emails (Basics) article.
You get an email that appears to be from your boss, a company owner, or another executive — usually sent while they're supposedly “in a meeting” or “traveling” and hard to reach by phone. It asks you to quietly handle something urgent, like sending a wire transfer, buying gift cards, or sharing sensitive files, and stresses that it's confidential and time-sensitive. This is often called Business Email Compromise (BEC) or “CEO fraud.”
Subject: Quick task
From: John Smith <john.smith@savemyservicee.com>Are you at your desk? I need you to process a wire transfer for me today — I'm stuck in back-to-back meetings and can't call. Keep this between us for now, I'll explain later. Let me know when you're ready and I'll send the account details.
Sent from my iPhone
A near-miss domain. “savemyservicee.com” has an extra letter — easy to miss at a glance.
Secrecy and urgency together. “Keep this between us” combined with “today” is a classic pressure tactic to stop you from checking with anyone else.
An unusual request delivered only by email, with no phone call or in-person conversation, and a built-in excuse for why they're “unreachable.”
“Sent from my iPhone” is often added to explain away short, informal, or oddly-worded messages.
The message asks you to act before providing any specific details, so you commit to helping before you can spot anything wrong.
Slow down. Legitimate urgent requests can wait for a two-minute phone call.
Verify through a separate channel — call the person directly using a number you already have on file, or ask them in person. Don't reply to the email or use any phone number provided in it.
Check the sender's actual email address carefully for extra letters, swapped characters, or a different domain entirely.
Never make a payment or purchase based on an email request alone, especially one asking for secrecy.
Report the message to your manager or IT/security contact so others can be warned.
If you've already sent money, gift cards, or sensitive information based on a request like this:
Contact your bank or payment provider immediately — the sooner a transfer is reported, the better the chance of recovering it.
Notify your manager, finance team, and IT/security contact right away so they can watch for related fraud attempts.
If any of your account passwords may have been involved, see How Do I Change My Email Password? and change them immediately.
Understanding Spam and Phishing Emails (Basics)
Scam Spotlight: Fake Invoice and Payment Emails
Scam Spotlight: Lookalike Domains and Spoofed Sender Names