The Cost of Being Visible: How Executive Impersonation Became a Mainstream Business Risk

Half of UK businesses have been targeted by fraudsters impersonating senior leaders in the past year. That is the headline finding of new research from Gallagher, the insurance broking and risk management firm, and it points to an uncomfortable paradox. The more visible senior executives become online, the easier they are to imitate. Average incident costs exceed £758,000, and in the most serious cases organisations report losses between £1.1 million and £5 million from a single episode.

What Criminals Find Online

The study describes how little effort it takes to build a convincing impersonation. LinkedIn profiles, company websites, social media posts and public speaking engagements all give criminals material to work with. A leader’s role, movements and personal details become the raw ingredients for a message that looks and sounds credible, whether it targets employees directly or the organisation as a whole.

How the Deception Works

Fraudsters pose as CEOs, CFOs or other senior colleagues, using fake email addresses, cloned voices or AI generated video. The aim is to pressure employees into authorising payments, sharing sensitive information or bypassing internal controls. According to the report, these attacks work because they exploit trust and authority: people act faster when a request seems to come from the top, especially when it comes with urgency, time pressure or the suggestion that the executive is travelling and cannot be reached.

A Risk That Has Gone Mainstream

Just over half of the organisations surveyed faced at least one impersonation or deception attempt in the past year, and 56% of business leaders say these incidents are becoming more frequent. AI enabled deception is now the first concern for directors, named by 51% of them, ahead of more traditional digital and physical security risks. Some 45% say they are highly exposed to phishing and social engineering, 40% to deepfake scams, and 13% mention kidnap for ransom as a concern, particularly where travel is involved.

The Damage Goes Beyond the Money

The financial loss is only part of the picture. After an extortion attempt, 48% of organisations reported higher anxiety among staff and 38% suffered reputational damage or a loss of client trust. One in three had to take legal advice or report an incident to a regulator, to avoid scrutiny over possible breaches of data protection, financial conduct or governance requirements. Jonathan Rae of Gallagher sums up the shift: executive risk is no longer only physical, as attacks now arrive through inboxes, phone calls and video, and protection has to keep pace with that exposure.

What It Means for Leadership and Organisations

This is not only a security question. It touches how leaders are seen, how decisions are authorised and how much an organisation’s culture allows an employee to question an urgent request, even one that appears to come from the CEO. It is a theme close to the work Euren does every day with senior leaders and boards, across executive search, governance and business advisory: clear decision rights that do not depend on a single message, verification habits that are part of how a company works, and a leadership style that makes it normal to double check. The visibility that helps leaders build trust and attract talent can be managed, but only if organisations treat it as part of how they lead.