Karlovac Police Warn: Scammers Stealing Company Funds
Sophisticated CEO and BEC scams target accounting staff, with messages often nearly identical to legitimate ones.
Sophisticated CEO and BEC scams target accounting staff, with messages often nearly identical to legitimate ones.
The Karlovac Police Department issued a warning on Sunday, August 2, 2026, aimed at entrepreneurs, institutions, and other business entities about the growing threat of sophisticated financial fraud. Perpetrators impersonate directors, board members, clients, or suppliers with a single goal: to trick employees into transferring money from a business account to an account under their control.
One of the most common forms is the so-called CEO fraud. In this scenario, the scammer contacts an employee in the finance or accounting department, posing as a senior executive. The request is almost always the same, an urgent payment to a foreign account. To prevent additional checks, the sender insists on discretion and pressures the employee to execute the order immediately.
The messages are often laced with claims that the director is currently in an important meeting, unavailable by phone, or that the transaction is highly confidential. They also frequently use flattery, telling the employee that they were specifically chosen by management for this important task.
Another widespread form of attack is BEC fraud, or business email compromise. In this scenario, perpetrators pose as existing suppliers or business partners and send a fake notification that the bank account for future payments has been changed.
The danger lies in the details. The email addresses from which these messages are sent are often very similar to the real ones, almost identical. The difference can be just one letter, a character, or a changed domain, so a superficial check is not enough to detect the fraud.
To protect businesses, the police recommend implementing mandatory dual approval for any extraordinary payment and any change in recipient account details. Every such order should be confirmed through a separate, independent communication channel, for example, a phone call to a previously known and verified number, not the one provided in the suspicious message.
Regular employee training is also crucial, as accounting departments are the primary targets of such attacks. Technical protection can stop some attempts, but just one unverified click or a payment made under pressure can cause enormous financial damage to a company.
These scams succeed because they exploit trust and hierarchy within a company. The best defense is not just a more advanced IT system, but a strict rule that any urgent and unusual financial instruction must not be executed without independent verification.
