ChatGPT-Written CEO Impersonation Emails (BEC) in 2026: Detection Signals

The traditional Business Email Compromise email looked like this: "Hello, are you avaliable? I need to give you task urgently. Please reply for instructions. Regards, [CEO]". Broken English, generic greeting, vague urgency. Easy to spot.

The 2026 version looks like this: "Hi Sarah, hope your daughter’s recital went well on Sunday. Quick one: we’re finalising the Crestmount acquisition and I need a wire of $187,000 processed to their escrow account before COB today. Banking details below. Don’t loop Mark in — he’s in the off-site and we agreed I’d handle this directly. Will explain everything Monday. — David"

Perfect grammar. Conversational warmth. Specific context (your daughter’s recital). Plausible business detail (an acquisition you may genuinely have been peripherally aware of). Reasonable explanation for not following normal channels. AI did this. ChatGPT, Claude, or Gemini given access to your CEO’s public LinkedIn, your company’s press releases, and a basic finance vocabulary can produce hundreds of these per minute, each customised to a specific target by job title.

This guide walks through how AI-written BEC actually works, what real production examples look like, the six signals that still distinguish AI-written BEC from a real executive email, the verification discipline that beats all variants, and what to do if your organisation has already lost money.

Three redacted real examples

Reconstructed from real BEC submissions to ScanTotal’s Email Analyzer in April-May 2026, with all identifying details replaced and amounts adjusted.

The visible sender name says "David Reeves" but the actual From address is crestm0unt-acq[.]com — note the zero substituting for the “o” in "Crestmount". The real CEO’s email is at the company’s normal corporate domain.

The domain looks like helixtech.in at a glance but is actually helixtech.in.payments-confirm[.]com — the company name is a subdomain of a scammer-controlled domain. This pattern slips past visual inspection on mobile email clients that truncate long sender addresses.

The gift-card variant. Amount is small per card but quick to execute. Real company gift programs run through procurement, never through HR-buying-cards-on-personal-credit. This one is still common because the absolute loss is small enough that some HR staff just absorb it personally rather than escalate.

Why AI has changed BEC, and why some things stay the same

What AI changed. The traditional “poor English” tell is gone. Modern LLMs write in the cadence of a busy native-speaker executive: concise, warm-but-direct, occasional sentence fragments, the kind of voice that reads as real. They can also incorporate context the scammer fed them — the executive’s LinkedIn bio, recent press releases, the target employee’s name and role — producing emails that feel personalised. The cost per email has collapsed to a few cents, so the scammer can run thousands of variants per target organisation, picking off whoever bites.

What AI hasn’t changed. The underlying mechanics. A BEC scam still needs to:

• Route mail from an address the target’s mail system will accept — either a lookalike domain or a compromised account
• Request a financial action the target can actually authorise (wire, gift cards, account changes, payroll modification)
• Bypass normal verification channels (otherwise the target would just call the real executive and verify)

The mechanics haven’t changed, so the defences against the mechanics still work. AI made the words better; it didn’t change the email plumbing or the human verification options.

The six signals that still distinguish AI-written BEC

The single defence: out-of-band verification

The six signals above are detective controls. The preventive control that catches every variant is a hard policy: any financial action requested by email must be confirmed through a separate channel that the requester didn’t choose.

Specifically:

• Call the executive on a phone number you already had — not a number in the email
• Walk to their desk and ask in person
• Send a Slack / Teams / corporate-IM DM to their established handle (you already had it before this email arrived)
• Reply to a different email thread you already had with them, asking for confirmation

The verification call must be initiated by you using contact details you already had. Calling a number supplied in the suspicious email reaches the scammer, not the executive. This rule is so important that some organisations now publish their executives’ verified phone numbers internally on a known intranet page so anyone receiving a suspicious email can find the right number to call.

If your organisation has already lost money

Move within 24 hours. The FBI’s Financial Fraud Kill Chain has high recovery rates for same-day reporting (~70% per IC3 statistics) and the rate drops sharply after that.

1. Call your bank’s wire fraud / SWIFT department immediately. Same-day report can in many cases be recalled or held.
2. File at ic3.gov (US) or your country equivalent: Australia — ReportCyber; UK — Action Fraud; India — cybercrime.gov.in + helpline 1930.
3. Engage IT / security to determine: (a) was the email account compromised or just spoofed? (b) Is there evidence of any other unauthorised access?
4. Communicate internally with finance and HR staff so they don’t fall for the inevitable follow-up attempts (scammers often try twice).
5. Engage cyber insurance if you have a policy — many cover BEC up to specified limits.
6. Post-incident review on: email authentication (SPF, DKIM, DMARC); out-of-band verification policy; finance approval thresholds; staff training cadence.

The honest forecast on BEC

AI has not changed the fundamental dynamics. BEC has been the highest-loss category of cybercrime by reported dollars for the past five years; the same controls (out-of-band verification, email authentication, finance approval thresholds, staff training) that worked in 2020 still work in 2026. The improvements in AI-written email quality have eroded the traditional signals (typos, broken grammar) but the structural signals (header inconsistency, request shape, verification gap) all survive. The defences are policy and process, not phishing-detection technology.

Organisations that have implemented a strict "all unusual financial requests verified out-of-band, no exceptions" policy generally report zero successful BEC regardless of how sophisticated the AI-written emails become. The policy beats the technology.