What should employees do when an executive email asks for money or confidential information?

When an executive asks for money or confidential information, what is the right response?

The right response is to treat the request as untrusted until it is verified through a separate channel. The business risk is not just phishing, it is also impersonation, inbox compromise, and pressure to act quickly. Employees should slow the process down, confirm the request using a known contact path, and refuse to send sensitive information or make payments based on email alone.

How should employees verify the request?

Verification should happen outside the message thread that contains the request. A phone call to a known number, a direct in-person check, or an instant message sent to a known account is better than replying to the email, because the original mailbox may already be compromised or spoofed. If the request changes, becomes urgent, or avoids normal approval steps, that is a warning sign rather than proof of legitimacy.

When the request involves payment, gift cards, bank details, passwords, personal data, or a confidential attachment, the safest assumption is that the email is testing for weak verification habits. Employees should also be careful with lookalike display names, reply-to manipulation, and “just this once” exceptions, because those are common ways attackers try to bypass normal scrutiny.

What should happen after a suspicious executive email?

If the message looks suspicious, employees should report it immediately through the organisation’s phishing or security-reporting process and avoid forwarding it to colleagues as a normal email conversation. The goal is to preserve the message for investigation and stop a possible scam from spreading. If any data or money was already sent, the incident should be escalated at once so the organisation can assess whether the mailbox, payment process, or account has been exposed.

For teams that support executives, assistants, finance staff, and other high-target roles, Security Awareness for Executives and Assistants Guide is a useful reference for building the verification habits that reduce business email compromise risk. It is especially relevant where urgent payment requests, mailbox delegation, or impersonation attempts are part of the normal working pattern.

Risk and Threat Considerations

Executive impersonation works because it exploits trust, urgency, and normal business authority. The main risk is not only loss of money, but also disclosure of confidential information that can be used for follow-on fraud, account takeover, or targeted social engineering against finance, legal, or senior leadership.

Failure mechanism: The attacker relies on a believable executive persona, a rushed request, or a compromised mailbox to override the employee’s normal approval process and bypass independent verification.

Impact: Payment diversion, disclosure of sensitive data, credential theft, and wider business email compromise can follow, especially if staff treat email as sufficient evidence of authority.

Practitioner Guidance

What to prioritise: Make the out-of-band verification step the default for any unusual money request or confidential-data request, especially when the message is urgent, private, or outside normal workflow. The key judgement is whether the request changes the approval path, not whether the sender appears senior.

What to verify: The contact path must be independently known, not copied from the suspicious email. Confirm both the person and the request content, since attackers often get one of those two elements right.

Decision rule: If the email asks for payment, credentials, bank changes, personal data, or gift cards, do not act on it until it has been confirmed through a trusted channel and matched to a normal business process.

Practitioner takeaway: In executive-impersonation cases, speed is the attacker’s advantage, so the correct control is disciplined delay plus independent confirmation, not email-based common sense.

Related resources from NHI Mgmt Group

• What happens when employees send sensitive information to the wrong recipient without real-time email controls?
• What should employees do when a holiday message asks them to buy gift cards or donate through an urgent executive request?
• What happens when employees receive a convincing executive impersonation email without a verification process?
• What should organisations do when a vendor or executive email asks for a bank transfer?