CEO Invoice Email Attack Principle
An accounting intern receives an invoice via email from the Chief Executive Officer (CEO). In the email, the CEO demands the immediate release of funds to the bank account that is listed. Which of the following principles best describes why this attack might be successful?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The core concept is Authority; the trap is confusing it with urgency or scarcity when the primary lever is the victim's respect for hierarchy.
This question examines the psychological principles behind social engineering attacks, specifically targeting the authority bias exploited in CEO fraud scenarios. The correct answer identifies why impersonating a high-ranking executive leads to compliance.
Learners often select Scarcity because of the 'immediate' demand, but failing to recognize that the power dynamic (Authority) is the root cause of the trust.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The attack described is a classic Business Email Compromise (BEC) or CEO fraud scenario. The attacker succeeds primarily by exploiting the principle of Authority. In social engineering, individuals are conditioned to obey figures perceived as having higher status or power, such as a CEO. The intern complies not necessarily because of the time pressure alone, but because they feel compelled to follow the directive of their superior.Why the Other Options Are Wrong
Scarcity refers to creating a sense of limited availability or time, which is present here ('immediate release'), but it is secondary to the authority figure issuing the command. Without the CEO's identity, the same urgent request from an unknown sender would likely be ignored. Consensus relies on the idea that 'everyone else is doing it,' which is irrelevant here. Familiarity involves building rapport or using known entities to lower defenses, whereas this attack uses a known role but impersonates the specific individual to leverage power.Community Comment Notes
The community consensus strongly supports Option A. As ps1hacker noted, the success is due to 'Authority - since its coming from the CEO.' Other users like Cathylux and Gabuu confirmed that Authority is the definitive answer, highlighting the importance of recognizing hierarchical manipulation in security exams.Exam Strategy
When analyzing social engineering questions, identify the primary psychological trigger. If a high-status individual is involved, look for 'Authority'. If the attacker tries to make you feel left out or rushed due to limited resources, consider 'Scarcity' or 'Urgency', but always weigh which factor is the primary driver of the victim's action.
Frequently Asked Questions
Why isn't Scarcity the best answer?
While urgency is used, the primary reason the intern complies is the fear/disrespect of disobeying the CEO. Authority overrides the scarcity tactic.
What is CEO fraud called in security?
It is often called Business Email Compromise (BEC) or Executive Impersonation, relying heavily on the Authority principle.