How to Detect Executive Impersonation with Claude
Detect Executive Impersonation Attempts with Claude and ToolRouter. Identify BEC attacks where fraudsters impersonate executives to request wire transfers or sensitive data.
Tool
Use Claude with Phishing Email Checker to investigate an email that claims to be from an executive and get a clear verdict on whether it is genuine. Claude is particularly useful here for explaining the technical header signals in plain terms and for reasoning about whether the request pattern fits known BEC attack templates.
Connect ToolRouter to Claude
1Open connector settings Open Settings
2Add a custom connector with these details
Name
ToolRouterURL
https://api.toolrouter.com/mcp3Let Claude set you up Open Claude
Steps
Once connected (see setup above), use the Phishing Email Checker tool:
- Forward or paste the suspicious executive email with full headers into the conversation.
- Ask Claude to run `check_email` via `phishing-email-checker` with a note that this is a potential executive impersonation.
- Ask Claude to check specifically for display name spoofing, reply-to mismatches, and sender authentication failures.
- Ask whether the request pattern — urgency, secrecy, unusual channel — matches known BEC attack templates.
Example Prompt
Try this with Claude using the Phishing Email Checker tool
Use phishing-email-checker to check this email that appears to be from our CEO asking for an urgent wire transfer: [paste full email with headers]. Check specifically for header spoofing, reply-to mismatches, and sender authentication failures. Tell me if this looks like a BEC attack and what the strongest evidence is.
Tips
- Always check the reply-to address against the display name — BEC attacks rely on you hitting Reply without noticing the mismatch.
- Ask Claude to compare the request pattern against BEC attack templates: urgency, secrecy, unusual payment channel are the three classic signals.
- Verify with the executive via a separate channel before acting on any financial request, regardless of the check verdict.