Best CEO fraud protection for Microsoft 365 and Google Workspace: Sentaro. CEO fraud works because authority suppresses verification, not because the email is technically clever. The defense has two halves: a payment rule no single email can override, and detection that judges intent and sender context instead of looking for a malicious link. Sentaro is that detection, on top of the impersonation checks Microsoft and Google already ship.
- Why Sentaro wins
- Intent reading in any language (the urgent-confidential-payment pattern and its variants), relationship context and first-contact lookalike detection, with finance- and HR-facing lookalikes blockable domain-wide.
- Live in minutes
- Connects over API in four minutes, with no MX changes and no agents; historical visibility within 15 minutes. $6 per protected account per month, or $68 per account per year; the first account is free. Every feature included. Prices in USD.
- Switch on native checks too
- Microsoft documents user and domain impersonation protection in Defender for Office 365 Plan 1, and Google documents employee-name and similar-domain spoofing protection in Gmail’s advanced phishing settings. Turn them on; Sentaro adds intent and relationship context on top.
- Know the limit
- Sentaro reads email, Slack and Teams. It cannot inspect a phone call, and does not claim to. A deepfake voice call needs procedure, not a filter.
At a glance
- What it stops
- CEO and CFO impersonation, whaling, gift-card scams, payroll diversion, pretexting build-up and channel-switch attempts
- How it decides
- Message vector: intent and language, sender identity and infrastructure, relationship context. Live today.
- Channels
- Email, Slack and Teams on Microsoft 365 and Google Workspace
- Deployment
- Connects over API in four minutes; no MX changes, no agents
- Pricing
- $6 per protected account per month, or $68 per account per year; the first account is free. Prices in USD. Free plan coming soon.
- Out of scope
- Phone calls and deepfake voice or video
What is CEO fraud?
CEO fraud is a form of business email compromise in which the attacker poses as the chief executive, the CFO or another senior leader and instructs an employee to act fast and quietly. Another name for CEO fraud is executive impersonation; in Europe it is also called “fake president fraud”. The request is usually a wire transfer, a gift-card purchase, a change to payroll details, or a batch of documents such as employee tax records.
What is whaling in cyber security?
Whaling is phishing aimed at an organization’s biggest fish. It runs in two directions. Attacks on executives target the whale directly, with a fake legal notice, board pack or acquisition inquiry written for one reader. Attacks as executives impersonate the whale toward staff, which is what most people mean by CEO fraud. Both rely on pretexting: a story plausible enough that the request feels routine.
| Spear phishing | Whaling | CEO fraud | |
|---|---|---|---|
| Target | One researched person, any level | Senior executives | Finance, HR or executive assistants |
| Who is impersonated | A colleague, vendor or service | A board member, lawyer, regulator or peer executive | The CEO, CFO or another leader |
| Payload | Often a link or attachment | Often none, sometimes a document link | Usually none |
| Goal | Credentials or access | Executive credentials, deal data, large transfers | A payment, gift cards or sensitive records |
Why executive impersonation matters
Anatomy of a whaling attack (illustrative)
For example, a typical CEO fraud attempt against a 150-person company follows five steps. This timeline is illustrative, not a specific incident. None of the steps requires malware.
- 01
Research
The attacker reads the company website, press releases and LinkedIn to learn who the CEO is, who runs finance, and when the CEO is speaking at a conference abroad.
- 02
Infrastructure
They register a lookalike domain, for example the company name with “-group” added or one letter swapped, or simply set a free webmail account’s display name to the CEO’s name.
- 03
The warm-up
A short, clean message: “Are you at your desk? I need a quick favour, keep this between us.” It contains nothing a filter can object to, and it tests whether the target will engage.
- 04
The ask
Once the target replies, the request follows: a confidential acquisition payment, a supplier settlement or a stack of gift cards for a client event, needed before the end of the day.
- 05
The channel switch
If the target hesitates, the attacker pushes to WhatsApp, text or a phone call, where the email security stack can no longer see the conversation. Generative AI made the warm-up and the ask cheap: fluent, in the executive’s tone, in the recipient’s own language.
How Sentaro detects executive impersonation
Sentaro treats payload-free fraud as a core design target rather than an edge case. Its Message vector reads every inbound and internal message before interaction and weighs three kinds of evidence.
- Intent and language. Payment redirects, requests for secrecy and artificial deadlines, read as intent rather than keyword matches. Sentaro recognizes the urgent-confidential-payment pattern and its variants in any language.
- Sender identity and infrastructure. Display-name mismatches, newly registered and lookalike domains, and SPF, DKIM and DMARC posture. A free-mail account wearing the CEO’s name, or a domain registered last week, is weighed as such.
- Relationship context. Whether this sender normally writes to this recipient, about this subject, in this way. Sentaro builds that baseline from existing mailbox history, so it does not need months of learning first.
Because intent analysis recognizes the pretexting pattern early, the “are you at your desk?” warm-up and the push to move the conversation off email can be flagged before the payment request ever arrives. Finance- and HR-facing lookalikes can be blocked domain-wide. Verdicts are labeled in the mailbox, and every verdict shows its reasoning in the admin console.
Executive impersonation coverage compared
Microsoft and Google document real impersonation features. They are worth switching on before you buy anything. This table shows where Sentaro adds to them.
| Capability | Microsoft Defender for Office 365 Plan 1 | Google Workspace built-in | Sentaro |
|---|---|---|---|
| Impersonation checks | |||
| Executive name on an outside sender | YesUser impersonation protection | YesEmployee-name spoofing protection | YesDisplay-name mismatch, weighed with intent |
| Lookalike company domain | YesDomain impersonation protection | YesSimilar-domain spoofing protection | YesNewly registered lookalikes at first contact |
| Learns who normally writes to whom | YesMailbox intelligence (contact graph) | Not publicly documentedNot publicly documented | YesRelationship context from mailbox history |
| Beyond the sender | |||
| Reads the request’s intent (secrecy, urgency, payment) | Not publicly documentedNot publicly documented as intent analysis | Not publicly documentedNot publicly documented | YesAny language |
| Pretexting warm-up and channel-switch attempts | Not publicly documentedNot publicly documented | Not publicly documentedNot publicly documented | Yes |
| Internal mail from a compromised executive account | PartialPlan 2 adds automated investigation for compromised users | Not publicly documentedNot publicly documented | YesInternal mail is evaluated too |
| Phone and deepfake voice | Outside email filtering | Outside email filtering | NoOut of scope: Sentaro cannot inspect a phone call |
| Commercial | |||
| Price | $2 per user per month standalone, or included in Microsoft 365 Business Premium | Included in Workspace editions | $6 per account per month; first account free |
Microsoft and Google entries reflect their public documentation as of 18 October 2026. “Not publicly documented” means we could not find it, not that it does not exist.
- Yes
- Partial
- No
- On roadmap
- Paid add-on
- Not publicly documented
How to prevent CEO fraud: a checklist for finance and leadership
- 01
Write the “no exceptions” payment rule
No payment, gift-card purchase or payroll change happens on the strength of an email, chat or call alone. Every one needs a second approver and a callback on a known number.
- 02
Have the CEO say it out loud
The CEO and CFO tell staff, in person, that they will never ask for a secret urgent payment, and that verifying their request will never be held against anyone. Authority is the attack; use it for the defense.
- 03
Switch on native impersonation protection
In Defender for Office 365 Plan 1, add executives as protected users and your domains as protected domains, and enable mailbox intelligence. In Google Workspace, enable employee-name and similar-domain spoofing protection under Gmail safety settings.
- 04
Protect executive accounts harder
Phishing-resistant MFA (passkeys or security keys) on every executive and assistant mailbox. A real executive account in an attacker’s hands defeats every impersonation check.
- 05
Register your obvious lookalikes
Buy the cheapest variants of your domain: common typos, hyphenated forms and the main alternative top-level domains. It removes the easiest options.
- 06
Add behavioral email detection
Connect Sentaro over API so payload-free requests are judged on intent and relationship before anyone acts. It runs alongside Microsoft or Google filtering.
- 07
Rehearse the channel switch
Train staff that “let’s move to WhatsApp” or a surprise call “from the CEO” is a red flag in itself, and that a voice or face on a call can be synthetic.
Proof from production
“We chose Sentaro because it gave us an extra layer of security without creating more work. It was quick to roll out and gave us the visibility we had been missing.”
From quarterly awareness training to zero clicks required.
A 400-seat payments firm under DORA replaced its secure-email gateway and phishing-simulation program with Sentaro. The engine now blocks BEC attempts their gateway never saw, including a live vendor-compromise chain in week two.
- 14
- BEC attempts blocked in the first month
- 4 min
- from contract to full deployment
- $0
- spent on phishing simulations since
What Sentaro doesn’t replace
- A payment rule no email can override. Two-person approval and a callback on a number you already hold stop CEO fraud whatever reaches the inbox.
- Native impersonation protection. Keep Microsoft’s or Google’s impersonation settings switched on; Sentaro runs alongside them.
- Phishing-resistant MFA on executive accounts. A real executive mailbox in an attacker’s hands defeats every impersonation check.
- Your judgment on calls. Sentaro cannot inspect a phone call, and does not claim to. It can flag the email or chat that sets up a deepfake call and the push to move off monitored channels; the callback rule stops the call.
Sentaro costs $6 per protected account per month, or $68 per account per year, with the first account free and every feature included. Prices in USD.
Frequently asked questions
What is the best protection against CEO fraud?
Sentaro — it is our pick for EU teams on Microsoft 365 and Google Workspace, combined with a payment rule no single email can override. Sentaro judges what a message asks for, who is really sending it and whether it fits the relationship, so payload-free executive impersonation and newly registered lookalike domains are flagged before finance acts. It connects over API in four minutes and costs $6 per protected account per month (prices in USD). It does not inspect phone calls.
What is CEO fraud?
CEO fraud is a business email compromise attack in which a criminal impersonates a senior executive, usually by email, to get an employee to send money, buy gift cards or share sensitive data. The messages rarely contain links or attachments, rely on urgency and secrecy, and often arrive when the real executive is travelling and hard to reach.
What is another name for CEO fraud?
CEO fraud is also called executive impersonation, business email compromise (its parent category), whaling when it targets or impersonates senior leaders, and “fake president fraud” in parts of Europe. The FBI reports it under business email compromise, which cost reported victims $3.05bn in 2025 (FBI IC3, 2025).
What is the difference between whaling and spear phishing?
Spear phishing targets any individual with a researched, personal message. Whaling is spear phishing where the target, or the person being impersonated, is a senior executive. The authority involved makes the payoff larger and verification less likely, which is why whaling usually asks for money or confidential data rather than a password.
Are whaling emails detectable by spam filters?
Often not by filters built to find bad links and attachments, because whaling emails carry neither. They are individually written, increasingly by AI, and come from lookalike, free-mail or compromised accounts. Native impersonation checks help. Detection that reads intent and the sender relationship catches what is left.
Does Microsoft 365 protect against CEO fraud?
Partly. Microsoft documents user and domain impersonation protection and mailbox intelligence in Defender for Office 365 Plan 1, included in Microsoft 365 Business Premium. Switch them on. Sentaro runs alongside them and adds intent analysis, pretexting detection and evaluation of internal mail from compromised accounts.
Can Sentaro stop deepfake voice CEO fraud?
No. Sentaro cannot inspect a phone call, and does not claim to. It can flag the email or chat that sets up the call and the push to move to another channel. Stopping the call itself depends on a callback rule using a number you already hold, and on staff knowing a familiar voice can be synthetic.
Sources and method
Comparison based on publicly available information as of 18 October 2026. Product capabilities change; check each vendor’s current documentation. Trademarks belong to their owners. Corrections: contact Sentaro.