Key points at a glance
- In CEO fraud, criminals pose as company management and push for an urgent, secret payment.
- DMARC with p=reject stops your exact domain from being forged for this – it doesn’t help against similar-looking addresses.
- Fixed rules prevent the damage: a call-back on a known number, and sign-off by a second person.
How the scam works
The fraudsters research your company beforehand: the names of management, who handles accounting, current projects. Then they write in the boss’s name to someone who can authorise payments – often while the real boss is travelling or on holiday.
- Pressure: the payment has to go out today, for example for a takeover or a fine.
- Secrecy: no one is allowed to know, not even colleagues.
- Unusual route: the payment should go to a new account, often abroad.
- Channel switch: a call or chat message follows later, sometimes with an imitated voice.
How to spot a fake boss email
Don’t just look at the displayed name, look at the whole sender address. Watch for a different reply address, an unusual greeting, a message sent “from my iPhone”, and any request that tries to bypass the usual process.
The name alone proves nothing
Anyone can choose the displayed name freely. An address that looks almost like yours is just as quickly registered.
Free domain check
Is your company address protected?
Enter your domain or your email address. You see the result right here, with a traffic light and a grade from A to F.
You opened a link to a result. The check only starts when you click, always with the current state.
Privacy: if you enter an email address, we transmit only the domain; the part before the @ never leaves your browser. We use the domain only for this check of public DNS records and do not store it in plain text; we do not store the result. We store your IP address only as a checksum and for at most one day to curb abuse.
The quick check is based on public DNS data at the time of the query and does not replace a full review; no warranty.
Keep an eye on it continuously instead of checking once:
Book a free initial callMonitor your domain – 14 days freePrefer some help? Ask us to set it up- No commitment
- No credit card
- Ends on its own after 14 days
No-obligation request by email · price on request
What happens next
- Your email program opens a prepared request with your domain. Add your name and send it.
- We get back to you and discuss with you or your IT partner which records (SPF, DKIM, DMARC) are needed and what the setup costs.
- The setup needs access to the DNS management of your domain. We agree the handover with you – please never send us passwords by email.
- If you wish, DomainRadar then monitors your domain continuously and alerts you when something changes.
No email program opens? Write to us with your domain at info@domainradar.ch.
Good to know: this protection stops anyone forging exactly your domain. Against look-alike addresses, always confirm payment changes by phone.
All checks
Quick check based on public DNS records. Continuous monitoring also checks certificates, blocklists and your DMARC reports.
Your result as a PDF
As a report to keep or to forward to your IT.
Free and without an account: you confirm your address by email and can unsubscribe at any time.
What DMARC does against it – and what it doesn’t
If your domain is protected with DMARC at p=reject, most large mail providers reject emails that forge your domain. The fake boss can then no longer write using your real address. DMARC doesn’t help against similarly spelled domains, senders using private email addresses, or hijacked mailboxes. That’s why you also need clear rules in day-to-day operations.
The rules that prevent the damage
A fixed process protects you even when an email looks perfect. Write it down, and make sure everyone knows the boss explicitly wants it followed.
- PauseDon’t act immediately on pressure and secrecy.
- Call backCall the person on a known number, never the number from the email.
- Two-person ruleA second person signs off every unusual payment.
- Only then payThe payment is only released once both checks out.
If it has already happened
Call your bank immediately – a payment can often still be stopped in the first few hours. File a report with the police and report the case to the Swiss Federal Office for Cybersecurity (FOCS).
Frequently asked questions
Is CEO fraud the same as boss fraud?
Yes. CEO fraud and boss fraud describe the same scam: criminals pose as company management and demand an urgent payment.
Does DMARC fully protect against CEO fraud?
No. DMARC only stops someone from forging your exact domain. Against similar domains, private email addresses or hacked mailboxes, a call-back and the two-person rule help.
Who is especially at risk?
Anyone who can authorise payments, especially in accounting and reception. Small companies are affected just as much as large ones.
How DomainRadar helps
DomainRadar shows whether your domain is protected against forgery, guides you step by step to p=reject, and flags similarly spelled domains. If someone sending email in your name turns up in the DMARC reports, you get an alert.
The domain check stays free. Afterwards you test DomainRadar with all features for 14 days – no credit card, the trial ends on its own.