Summary
Sometimes you or members of your staff receive fraudulent emails and text messages that appear to come from important people, executives, etc. They do not. This tactic, called executive impersonation or business email compromise, relies on trust in a familiar name and a sense of urgency to get you to act before you think.
Typical requests include buying gift cards, sending a wire or payment, sharing a login code, clicking a link, or “quickly” replying with personal or donor information.
These email and text message-based attacks are not related to the recent Malware attacks on the Apex Media servers. All Apex Media client websites were impacted by the Malware incidents which did not involve email or text message exploitation.
Two things to remember:
- A message that uses an executive’s name is not proof that the they sent it.
- Never act on an urgent request for money, credentials, or data until you confirm it through a separate, trusted channel.
How to recognize an impersonation attempt
Scammers copy a real name, but they usually slip on the details. Watch for these signs.
| Red flag | What it looks like |
| Unfamiliar sender address | The display name says the executive’s name, but the email address is a personal account (such as Gmail or Outlook) or a near-match domain with a swapped or added letter |
| Unknown phone number | A text from a number you do not have saved, often opening with “Are you available?” or “I need a quick favor” |
| Urgency and secrecy | “Need this done in the next hour,” “Don’t call, I’m in a meeting,” or “Keep this between us” |
| Unusual request | Gift cards, wire transfers, changed payment details, W-2 or donor lists, or a request to purchase something and be reimbursed |
| Moving to a new channel | A push to switch from email to text, WhatsApp, or Telegram so the conversation is harder to monitor |
| Odd tone or wording | Generic greetings, stiff phrasing, or language the executives would not normally use |
| Links and attachments | Unexpected “shared document” links, login pages, or QR codes |
| Reply-to mismatch | Replying sends your message to a different address than the one shown |
A message can still be fake even if it looks polished. Scammers now use AI tools to write convincing text and, in some cases, to imitate voices. Judge the request, not the polish.
Prevention tips
Verify before you act
- Confirm any request for money, gift cards, payment changes, or sensitive data by calling the requester on a number you already know. Do not use contact details from the message.
- Use a second approver for payments, vendor banking changes, and donor or member data requests, no matter who appears to be asking.
- Treat “urgent and confidential” as a reason to slow down, not speed up.
- If someone truly needs something unusual, they will understand a quick verification call.
Protect your accounts
- Turn on multi-factor authentication (MFA) for email, banking, and cloud accounts. Prefer an authenticator app or security key over text message codes.
- Never share a verification code with anyone, including someone claiming to be IT or leadership.
- Use a password manager and a unique password for every account.
- Keep devices, browsers, and apps updated.
Handle messages safely
- Hover over links before clicking. When in doubt, type the website address yourself.
- Do not open unexpected attachments, even from known contacts.
- Do not reply to or tap links in suspicious texts, including “STOP” replies, since that confirms your number is active.
- Add external-sender warning banners to email where possible. Apex Media can help configure this.
Limit what scammers can learn
- Review what is posted on your website, social media, and event pages. Public lists of board members, staff roles, email addresses, and phone numbers make targeting easy.
- Consider listing role-based contact addresses (such as info@) instead of individual staff emails.
- Avoid posting travel plans, out-of-office details, or organizational charts publicly. Scammers time attacks to when leaders are unreachable.
- Use official domain email and approved messaging channels for business, not personal accounts.
What to do when you receive a suspicious message
- Stop. Do not reply, click links, open attachments, scan QR codes, or call numbers in the message.
- Do not engage. Replying, even to say “who is this?”, confirms your address or number is active.
- Verify if needed. If the message might be real, contact the executive using a phone number or email you already have, not the one in the message.
- Capture it. Take a screenshot showing the sender’s address or number and the full text. Forward emails as attachments if your system allows it.
- Block and delete. Block the sender and delete the message. On a phone, you can also report text spam by forwarding it to 7726 (SPAM).
- Tell colleagues if asked. Leadership may send a short alert so others know what to watch for. Share what you saw, not just that you saw something.
If you already clicked, replied, or sent something
Act quickly and do not be embarrassed. Fast reporting limits the damage, and no one will be penalized for reporting in good faith.
| If you… | Do this right away |
| Clicked a link or opened an attachment | Disconnect the device from the network and arrange to have it scanned for viruses. Do not keep using it until it is checked. |
| Entered a password | Change that password immediately from a different, trusted device. Change it anywhere else you reused it. Turn on MFA. |
| Shared a verification code | Change the account password and sign out all sessions. |
| Replied with personal or donor information | Report exactly what was shared to the your leadership so they can decide on next steps. |
| Bought gift cards | Keep the cards and receipts. Call the card issuer immediately to report fraud. |
| Sent a payment or wire | Call your bank right away and ask for a recall or fraud hold. |
Financial fraud can also be reported to the FBI Internet Crime Complaint Center at ic3.gov and to the Federal Trade Commission at reportfraud.ftc.gov.
Guidance for leadership
Executives’ and leaders’ names may be borrowed, and others can be next.
- Set expectations in advance. Tell staff how you will and will not make requests. For example: “I will never ask for gift cards or ask you to keep a payment secret.”
- Agree on a verification method. A call-back to a known number, or a short, shared code phrase for urgent requests, gives staff a simple way to confirm.
- Welcome verification. Respond positively when staff question a request. Never make anyone feel foolish for checking.
- Use Official accounts. Conduct business from official email, not personal accounts, so staff can recognize legitimate messages.
- Secure your own accounts. Turn on MFA for every email and phone account. Fraudsters sometimes break into a real executive account, which makes a fake message look genuine.
- Send a brief alert. When a new wave appears, send a short notice to staff and board describing what the fake messages look like.
- Review public exposure. Trim contact details and role information that is easy to scrape from the Foundation’s public channels.
Quick reference
Before you act on any request, ask:
- ☐ Is the sender’s address or number exactly what I expect?
- ☐ Is it asking for money, gift cards, codes, passwords, or data?
- ☐ Is it urgent, secret, or pushing me to a new channel?
- ☐ Have I confirmed it by calling a number I already know?
If the answer to any of the first three is yes, or the fourth is no, stop and verify.
Who to contact
| Need | Contact |
| Technical help, compromised device or account | Apex Media Support support@apex-media.com (919) 263-4244 |
| Verify a request from a leader | Call the leader at their number on file |
| Report fraud externally | ic3.gov and reportfraud.ftc.gov |
Prepared by Apex Media Holdings, LLC