How we stopped CEO impersonation emails before they reach the inbox

Fake CEO emails tried to move our staff into LINE groups. Two Microsoft 365 mail flow rules now quarantine them before delivery.

Someone has been emailing LOGIQ staff while pretending to be our CEO. On 12 November 2026 we put mail flow rules in place in Microsoft 365. Emails like these are now quarantined before they reach anyone’s inbox. Here is what happened, what we set up, and what other companies can copy.

What happened

The emails came from addresses outside LOGIQ. The sender display name showed our CEO’s name, so the message looked like it came from him at a glance. The request was always the same: create a group in LINE, a messaging app, and send back its QR code or invite link.

No money or passwords were requested in the email itself. That is the trick. The email only has to get you onto a channel where our mail security can’t see the conversation. The real request (usually a payment, a gift card purchase or confidential files) comes after that.

Why this scam works

It relies on three habits most of us have.

• We read the name, not the address. Most mail apps show the display name first and hide the real address. Anyone can set any display name on a free email account.
• We say yes to the boss. A short, slightly urgent note from the CEO doesn’t invite questions.
• The first request looks harmless. Making a chat group feels like nothing. But once the conversation leaves company email, your filters, logs and colleagues can no longer see it.

What we configured

We added two mail flow rules (also called transport rules) in Microsoft 365. They run on the server, before any message reaches an inbox, so nobody has to spot the scam themselves.

Rule	What it catches	What happens
Display-name impersonation	Email from outside LOGIQ whose sender display name imitates our leadership, in both Latin and Japanese spellings	Quarantined; each event is reported to leadership
Off-channel steering	Email from outside LOGIQ that tries to move the conversation to a chat app, such as asking for a LINE group QR code or invite link	Quarantined

The logic of the first rule is simple. Our leadership only sends instructions from @logiqlinux.com addresses. So an outside email using our CEO’s name is fraudulent by definition, and there is no reason to deliver it.

Quarantined messages are kept for 30 days. If a real message is ever caught by mistake, an administrator can release it.

The human layer

Filters catch most attempts, not all. So the rules come with a clear policy everyone at LOGIQ knows:

• Leadership gives instructions only through internal company channels, never from an outside email address.
• LOGIQ never asks anyone to move business into a personal chat group.
• If a suspicious message gets through, don’t act on it. Report it, and we’ll tighten the rules.

A policy like this makes the decision easy for staff. Nobody has to judge whether a message “feels” real. If it breaks the rule, it’s fake.

What other companies can do

You can set this up in an afternoon. Here’s what we’d recommend:

1. Quarantine outside email that uses your executives’ names. In Microsoft 365, create a mail flow rule: sender is outside the organization, and the From display name contains an executive’s name. Include every spelling and script your staff would recognise.
2. Quarantine attempts to move conversations off email. Match phrases that ask for chat-group invites, QR codes or personal messaging accounts, and limit the rule to external senders.
3. Quarantine rather than delete. Messages caught by mistake can then be released, and you keep the evidence.
4. Send each hit to someone who acts on it. A sudden rise in matches is an early warning that your company is being targeted.
5. Write down how leadership really communicates. One sentence (“instructions only come from company addresses, through internal channels”) gives staff a simple test.
6. Turn on the built-in protections too. Mark external senders with a warning tag, and enable impersonation protection in your anti-phishing policy where your licence includes it.
7. Keep exceptions few and secret. Every exempt sender is a gap. Review the list regularly and never publish it.

The bottom line

CEO impersonation doesn’t need hacking, just a convincing display name and a reason to move the conversation somewhere else. Server-side rules take that choice away from the person reading the email, and a clear policy covers anything the rules miss.

Want help setting up mail flow rules or reviewing your email security? Contact the LOGIQ team.

Photo: Anete Lusina / Pexels