CEO fraud emails target payroll because one approved payment can move before anyone notices. This guide shows how to train payroll teams to stop CEO fraud emails in 2026 — with hard call-back rules, three drills, and a 30-day plan you can measure.
TL;DR
- Call-back-only policy stops CEO fraud emails in payroll faster than slides.
- FBI IC3 logged US$3.05 billion in BEC losses across 24,768 complaints in 2025.
- Verizon 2026 DBIR puts the human element in 62% of breaches.
- Run three payroll CEO-fraud sims in 30 days; target 20%+ report rate.
- Score blocked payments and call-back logs beside click rates.
Why this matters
Payroll staff open urgent messages from executives every week — bonus approvals, contractor pays, and last-minute corrections. Attackers copy that tone and that timing. A forged “from the CEO” note that lands Friday at 4:40 p.m. is not a generic phish; it is a payment request dressed as leadership.
In 2026 the economics still favour the attacker. IBM’s 2025 Cost of a Data Breach work put the average phishing-initiated breach at roughly US$4.8 million. One off-cycle transfer can be irreversible once it leaves the bank. Filters catch bad domains; they do not catch a lookalike display name and a tone your payroll clerk already trusts.
If you already run phishing simulations, turn that capability into a payroll-specific control — not another annual video.
What you'll need
- Written payment policy that bans bank, payee, or off-cycle changes on email instruction alone
- A fixed executive list for call-backs (desk and mobile numbers held outside email)
- Access to build bank-detail and executive-pretext phishing templates for payroll roles
- Thirty consecutive calendar days on the schedule
- One named owner in finance or security who signs results every Friday
- Seat access on a short-lesson training path for anyone who fails a drill
- Help-desk agreement so simulation domains are not blocked mid-pilot
The steps
1. Freeze the payment rule in writing before any drill
Publish one non-negotiable rule to every person who can release funds: no bank detail change, gift-card purchase, or off-cycle pay proceeds from email or chat alone. Confirmation must be a live call to a number already on file — never a number or link inside the request.
Put the rule on the intranet, in the payroll SOP, and in the finance onboarding pack the same week. Without the rule, training is advice people can overrule under pressure.
Expected outcome: every payroll and AP seat can quote the rule without opening a slide deck.
Common mistake: burying the rule inside a 40-page policy nobody opens during a live wire.
2. Map every path money can leave payroll
List systems and people who can add bank details, approve off-cycle pays, buy digital gift cards, or export payer files. Include contractors and backup approvers who cover leave.
Tag each path as primary (daily) or rare (annual bonus). Primary paths get the first simulations. Rare paths get a shorter mini-drill in week three.
Expected outcome: a one-page path map your owner can update each quarter.
Common mistake: training only headcount payroll while AP and the EA who process “CEO favours” stay untested.
3. Build three CEO-fraud templates that match real work
Write three payloads with public or synthetic detail only — never a live employee name or real bank account.
- Off-cycle bonus — “Confidential — process today, do not loop HR.”
- Bank switch for a senior contractor — “New account already board-approved.”
- Gift-card or prepaid run — “Need codes in 30 minutes for client gifts.”
Match tone to your real COO or CFO style without copying private signatures. Pair each template with a 3–5 minute security awareness training lesson that shows the red flags in that exact lure.
Expected outcome: three ready cadences staged in the platform before day seven.
Common mistake: reusing a generic IT password-reset sim that never teaches payment pressure.
4. Baseline, then run three sends over 30 days
Week 1: soft baseline to the payroll cohort only. Record open, click, report, and any payment step attempted on the landing page (no credential harvest).
Weeks 2–4: send the three CEO-fraud templates 7–10 days apart. Auto-enrol clickers into the matching lesson the same day. Celebrate reporters in the next team huddle without shaming clickers.
Expected outcome: click rate trend, report rate above 20% by week 4, and zero real funds moved off policy.
Common mistake: blasting the whole company on day one and treating noise as a payroll programme.
5. Wire call-backs into the release checklist
Add a mandatory field on the payment release form: Call-back completed — name, number on file used, time. No field, no release. Random-sample 10% of payments each week for compliance spot checks.
Where banking portals allow dual control, require a second person who was not on the original email thread. This pairs well with broader work on reducing business email compromise risk with staff training.
Expected outcome: call-back logging becomes as routine as attaching an invoice.
Common mistake: allowing “the CEO texted me” as a substitute for the on-file number.
6. Score people with behaviour, not attendance
Fold payroll phishing fails, late lessons, and missed call-backs into human risk reporting so leaders see who needs coaching — not just who finished a module in January.
Review the cohort every Friday for 30 days. After day 30, keep monthly CEO-fraud variants for finance while the rest of the firm runs the broader cadence.
Expected outcome: a one-page scorecard: baseline click %, week-4 click %, report %, call-backs completed %, payments blocked by policy.
Common mistake: declaring victory because completion hit 100% while report rate stayed near zero.
7. Brief executives so they stop bypassing the rule
Tell real executives the programme exists. Ask them never to request off-policy payments by email, and to expect a call-back every time. An executive who teases staff for “not trusting me” will wreck the control faster than any attacker.
Expected outcome: leadership acts as the second line of defence, not an exception path.
Common mistake: hiding the programme from the people attackers impersonate.
Troubleshooting
Click rate is near zero on the first send. Filters likely caught the domain, or the lure was too clumsy. Whitelist the simulation infra with IT, then resend a cleaner variant.
Staff say the drills feel unfair. Publish the rule set before day one: you test the payment paths attackers actually use in 2026, and reporters win recognition.
An executive insists on email-only approvals while travelling. Pre-issue a travel exemption process that still uses an out-of-band code or approved app — never a free email reply.
AP and payroll share an inbox. Split responsibilities or require dual control; shared inboxes make forged display names harder to spot.
Report rate stays under 10%. Show the report-phish button during the fail lesson and in the next standup. Measure report rate as hard as click rate.
Simulations stall after the pilot. Put a recurring monthly CEO-fraud slice on the calendar for payroll only; currency dies when finance returns to generic IT lures.
Tools and resources
- Phishing simulation library with invoice, bank-change, and executive-pretext templates
- Short story-led lessons tied to each fail
- Human risk scores combining training and phishing behaviour
- Payment SOP with call-back fields and dual control
- Gap assessment if you need to show leadership where payroll controls sit against Essential Eight-style evidence
- Public FBI IC3 BEC figures for the business case (US$3.05 billion in reported 2025 losses)
What to do next
Lock the call-back rule this week, stage the three templates, and book the 30-day window on the finance calendar. Currency is a calendar habit, not a project.
FAQ
How do you train payroll teams to stop CEO fraud emails in 2026?
Write a call-back-only payment rule, run three payroll-specific CEO-fraud simulations over 30 days, auto-enrol clickers into short lessons, and score report rate and blocked payments — not just course completion.
What is CEO fraud in payroll?
It is a BEC pattern where attackers impersonate an executive and pressure payroll or AP to move money, change bank details, or buy gift cards without a normal approval path.
How much do BEC attacks cost?
FBI IC3 reported US$3.05 billion in U.S. BEC losses in 2025 across 24,768 complaints. A single off-cycle payment can exceed a full employee’s annual salary.
Should payroll get different phishing simulations from the rest of staff?
Yes. Generic IT-reset lures do not rehearse payment pressure. Finance needs bank-change, off-cycle bonus, and gift-card pretexts.
How often should CEO fraud drills run after the first month?
Monthly for payroll and AP; quarterly variants for broader staff is a workable 2026 baseline.
Is a phone call-back still valid if the email includes a mobile number?
No. Only numbers already stored in your HR or vendor master file count. Numbers inside the request are part of the attack.
What report rate should finance aim for?
Push above 20% reporting on current templates while click rate trends down across the 30-day window.
Can filters alone stop CEO fraud?
No. Display-name spoofing and compromised real mailboxes bypass many filters. Process plus rehearsal closes the gap filters cannot.
One last thing
The quiet failure mode is a polished LMS dashboard and a finance inbox that still pays on Friday urgency. If your 2026 programme cannot show a call-back log next to the phishing trend line, you are measuring attendance, not payment risk. Put the rule, the drill, and the scorecard on the same page — that is what stops the wire.