Executives are targeted because their name carries approval power. A message that appears to come from a CFO does not need to defeat a control; it asks someone else to defeat it on the sender's behalf, and that request is entirely ordinary until it is not.
The public surface makes this cheap to build. Conference talks, press coverage, LinkedIn, podcast appearances and quoted interviews supply the vocabulary, the priorities and the writing style. Voice cloning has removed the last friction from the phone-call variant.
It usually runs outside anything the security team monitors: a lookalike social profile, a personal-looking email domain, a messaging app. There is no corporate log to alert on, which is why detection typically starts with someone external reporting it.
Removal is a brand-protection job rather than an incident-response one. The account or domain has to come down through the platform, the executive's real presence has to be verifiable, and the impersonator's next attempt has to be watched for, because a profitable target gets tried again.
How Fraudox handles it
Social media takedown