The Obituary Watch

A leadership change can create uncertainty that an attacker tries to exploit. Treat an urgent payment request as unverified until the organisation’s normal approval process has been followed. Use an established phone number or other independent channel, not contact details supplied in the suspicious message.

Here's how it works when a CEO dies:

  1. Scammer reads the obituary — identifies the company, the leadership vacuum
  2. Spoofs the CEO's email — or compromises it (it's probably still active and unmonitored)
  3. Emails the CFO or accountant — "I need you to wire $400k to this vendor for a deal I was closing before my illness. It's urgent. Keep this confidential."
  4. Staff, emotional and off-balance, comply without normal verification

The FBI has documented hundreds of these cases. The average loss is six figures. The success rate is disturbingly high, because dead CEOs can't deny sending the email.

The Leadership Vacuum Is the Attack Surface

In the days after a founder's death:

• Normal procedures are suspended • Decision-making authority is unclear • Staff are emotional and not thinking critically • IT oversight is reduced (the CEO may have been the IT decision-maker) • Email accounts remain active and potentially unmonitored

This is not a vulnerability in your firewall. It's a vulnerability in your organizational chart.

A Delayed Succession Backstop

ZeroLatch cannot prove death or incapacity, and its delivery timeline is not immediate. It observes missed check-ins, waits through the configured safety period, and then attempts to notify the recipient.

A business succession protocol should use independent human verification and formal authority. A ZeroLatch delivery can preserve supporting instructions, recovery contacts, and a tested runbook for an authorised VP, board member, or COO, but urgent account lockdown and fraud controls belong in the organisation's monitored incident-response process.

Controls that work on day one

Require out-of-band verification for new payees, dual approval above defined thresholds, business-owned mailboxes, rapid offboarding and a documented rule that executives never override payment controls by secret email.

When leadership changes, announce the authorised approvers through a verified channel and monitor forwarding rules, password resets and unusual invoices. Tabletop the scenario before a real crisis and record who can freeze payments or preserve evidence.