How to protect executive and VIP email accounts

Executives, finance staff and their assistants get a different kind of email attack: fewer messages, better researched, and aimed at money or access. This guide covers how to decide who your VIPs are, the two ways their email is attacked, and the specific settings in Microsoft 365 and Google Workspace that add protection where it matters most. For the attack types themselves, see spear phishing vs phishing vs whaling.

Why are executives targeted by email?

Executives are targeted because one successful message can authorize a payment, expose sensitive data or open access across the business. Attackers trade volume for precision: instead of millions of generic messages, they send a few researched ones to the people whose words carry authority.

Microsoft puts it plainly in its priority accounts guidance: "spear phishing or whaling attacks that target priority accounts are very rewarding for attackers. So, priority accounts require stronger than ordinary protection." Whaling is spear phishing aimed at senior people.

The money involved is large. The FBI's Internet Crime Complaint Center counted 305,033 business email compromise incidents and $55,499,915,582 in exposed losses between October 2013 and December 2023 (IC3 PSA, 2024). Many of those schemes rely on a message that appears to come from an executive, or on an executive's real mailbox after a takeover.

Who counts as a VIP?

A VIP, or priority account, is anyone whose mailbox or name can move money, data or access. Job title is a starting point, but access is what matters. Microsoft says priority accounts "include (but aren't limited to) CEOs, CISOs, CFOs, infrastructure admin accounts, build system accounts, and more."

CISA's phishing-resistant MFA fact sheet gives the same reasoning for the last rows: high-value targets include attorneys "who may have e-discovery permissions to read email, including deleted email, of staff members" and "HR staff, who may have access to personnel records."

Keep the list short, usually five to ten people in a small business, and review it when roles change.

What are the two ways VIP email is attacked?

VIP email is attacked in two directions: attackers either take over the VIP's real mailbox, or they impersonate the VIP to someone else. Each needs different controls.

What an impersonation email looks like

This is an example, not a real message. Note that it passes SPF, DKIM and DMARC, because the attacker sends from a domain they control:

From: "Jane Smith" <jane.smith.office@gmail.com>
Reply-To: jane.smith.office@gmail.com
To: accounts@yourcompany.com
Subject: Quick favor before my flight
Authentication-Results: mx.yourcompany.com; spf=pass smtp.mailfrom=gmail.com;
 dkim=pass header.d=gmail.com; dmarc=pass header.from=gmail.com

Are you at your desk? I need a wire sent to a new supplier today.
I'm boarding soon and can't take calls, so just reply here.

Authentication only proves the message came from gmail.com. It says nothing about whether Jane Smith sent it. That's why impersonation needs name-based checks and a process rule, not just DMARC. Our display name spoofing guide covers more examples, and you can read any suspicious message's headers in the Email Header Analyzer.

How do you protect VIP accounts in Microsoft 365?

In Microsoft 365, protect VIPs with stronger sign-in, the Strict preset security policy, and, if you have Microsoft Defender for Office 365, impersonation protection and priority account tags. Microsoft's priority accounts guidance lists the first two as available on all Office 365 Enterprise plans.

1. Require strong MFA and block legacy authentication. Microsoft recommends MFA and disabling legacy protocols for priority users. If you can't disable them for everyone, you can turn off POP3 and IMAP4 on individual mailboxes and enable authenticated SMTP only where needed. Prefer phishing-resistant methods such as passkeys; CISA calls phishing-resistant MFA "the gold standard."
2. Apply the Strict preset security policy. Microsoft's example: rather than delivering spam to the Junk Email folder, quarantine it for priority accounts. See our preset security policies guide.
3. Protect their names from impersonation (Defender for Office 365). In an anti-phishing policy, add VIPs under Users to protect. Microsoft allows "a maximum of 350 users for user impersonation protection in each anti-phishing policy." By default no users are protected and the action is Don't apply any action, so choose an action such as quarantine (Microsoft Learn). Our anti-phishing policy settings guide walks through the screens.
4. Protect your domains too. Domain impersonation protection catches lookalikes of your own domains; Microsoft allows up to 50 custom domains per policy.
5. Tag priority accounts (Defender for Office 365 Plan 2). The Priority accounts tag lets you filter alerts, reports and investigations for VIPs.
6. Review delegates. Check who has Full Access or Send As on each executive mailbox, and remove anyone who no longer needs it.

At the time of writing (October 2026), impersonation settings are only in Defender for Office 365 anti-phishing policies, not in the protection every mailbox gets. Compare the plans in Defender for Office 365 Plan 1 vs Plan 2.

How do you protect VIP accounts in Google Workspace?

In Google Workspace, enroll VIPs in the Advanced Protection Program and turn on Gmail's spoofing protections for employee names and similar domains.

1. Enroll VIPs in the Advanced Protection Program. Google describes it as "a curated group of high-security policies that are applied to enrolled accounts." It requires a security key or passkey to sign in, adds enhanced pre-delivery email scanning, and restricts third-party app access to account data. Google lists super admins, delegated admins and business leaders among the users at risk of targeted attacks that it helps protect (Google Workspace Admin Help). An admin enables enrollment, then each user enrolls and registers their keys.
2. Turn on employee name spoofing protection. Under Apps > Google Workspace > Gmail > Safety > Spoofing and authentication, the setting "Protect against spoofing of employee names" flags messages where the sender's name matches a name in your directory but the mail comes from outside (Google Workspace Admin Help). The default action keeps the message in the inbox with a warning; consider a stronger action once you've checked for false positives.
3. Turn on similar-domain protection in the same section, which targets domains that look like yours.
4. Enforce phishing-resistant 2-Step Verification with the "Only security key" method, which now accepts passkeys too. See 2-Step Verification enforcement.

More detail on these settings is in our Google Workspace advanced phishing and malware protection guide.

Which process controls protect executives?

Process controls protect executives where technology can't: a convincing message from a lookalike domain, or a real request from a compromised supplier. The most important is a written rule that any payment, bank-detail change or sensitive data request is confirmed by phone on a known number, including when it appears to come from the CEO.

• Make the rule come from the top. Executives should tell staff, in writing, that they'll never ask for an urgent secret payment by email and that verifying is always welcome. The BEC prevention guide has a ready-made procedure.
• Require dual approval for payments over a set amount.
• Limit what's public. Travel plans on social media and detailed out-of-office replies tell attackers when an executive is hard to reach. See out-of-office security risks.
• Give executives an easy way to report. VIPs are busy; a single Report button is more likely to be used than a forwarding procedure.
• Watch for mailbox takeover signs such as new inbox rules or unexpected forwarding on VIP and assistant mailboxes. See signs an email account is compromised.

VIP email protection checklist

Work through this list for every person on your VIP list.

1. Write the VIP list: executives, finance approvers, assistants, admins, HR and legal.
2. Phishing-resistant MFA registered and required for each one.
3. Legacy authentication (POP3, IMAP4, SMTP AUTH) off for their mailboxes, unless documented.
4. Admins use separate admin accounts without mailboxes.
5. Strict filtering applied (Strict preset in Microsoft 365, or Advanced Protection in Google Workspace).
6. Their names in impersonation or employee-name spoofing protection, with a real action set.
7. Your domain's DMARC policy at p=reject; check it with the DMARC Checker.
8. Lookalike domains of your brand monitored.
9. Delegates and Send As rights reviewed every quarter.
10. Phone verification rule for payments and data, signed by the owner.
11. External sender tags on, so outside mail that uses a VIP's name stands out.

Next steps

• Write your VIP list today and run the checklist above against it.
• Check your domain's DMARC, SPF and MX status with the free Email Health Check.
• If you're on Microsoft 365 without Defender for Office 365, apply the Strict preset policy to VIPs now; it doesn't require Defender for Office 365.
• iBlockSpam's Lookalike Domain Watch checks daily for look-alike versions of your domain and alerts you when one is registered or gets a mail server. It detects them; it can't take them down.