How to Find a CEO's Email Address and Phone Number (and Any Other Decision Maker's)
You can find one CEO's email address in about fifteen minutes. Open the company's leadership page, get the exact spelling of the name and the title, find one published address on the domain, work out the pattern, verify it, and you are done.
That fifteen minutes is the trap. The method that works beautifully for one contact does not survive fifty, and the list you assemble this week will be roughly a fifth wrong by this time next year. Most guides on this topic hand you thirteen methods in a flat list and leave you to work out which one you are supposed to use. That is the wrong shape for the question. The methods are not competing with each other. They sit at different volumes.
So this guide sorts every method into three tiers by the number of contacts it can actually carry, and it settles three things along the way: where companies publish leadership contact information, how to know an address is real before you send to it, and what you are legally allowed to do with it once you have it.
Quick Digest
- Companies publish more leadership contact information than most people check: the leadership or about page, press release footers, investor relations pages, regulatory filings, state business registries, licensing boards, and association directories.
- A leadership page rarely carries a CEO's direct address. What it reliably carries is the exact name, the exact title, and the company's email pattern, which is what every later step needs.
- Email pattern inference produces a hypothesis, not a contact. Generating six candidate addresses and mailing all six is five guaranteed bounces per person, and bounce rate is what governs your sending domain's reputation.
- Roughly four in ten enterprise domains are configured as accept-all, which means an SMTP check returns the same success code for a real mailbox and for random noise. A "verified" flag from a tool that skips the catch-all probe is a false positive.
- Phone is a separate data problem from email. Switchboard numbers are published, direct dials rarely are, mobile numbers almost never are, and none of them can be inferred from a pattern the way an email address can.
- B2B contact data decays at roughly 2.1% per month, compounding to about 22.5% per year, and phone numbers decay faster than email addresses.
- Most business-to-business calls are exempt from the National Do Not Call Registry provisions of the FTC's Telemarketing Sales Rule. That exemption does not cover the TCPA, and it does not cover state do-not-call laws.
- Manual discovery holds to roughly twenty or thirty contacts. Beyond that you are choosing between a subscription database and an extraction pipeline, and the deciding variable is how well an off-the-shelf database covers your specific target universe.
Who are you actually trying to reach?
"CEO" is the search query. It is rarely the answer.
At a fifty-person company, the founder, the managing director, and the CEO are usually the same person, and that person genuinely does make the buying decision. At a five-thousand-person company they are none of those things. Gartner's research on complex B2B purchases puts a typical buying group at six to ten decision makers, each arriving with four or five pieces of independently gathered information, and a 2025 Gartner survey widened that range to five to sixteen people across as many as four functions.
Note
Six to ten people. Gartner finds that a typical complex B2B purchase runs through a buying group of six to ten decision makers, each bringing four or five independently gathered pieces of information to the table.
That changes what you are looking for. You are usually mapping four roles rather than finding one person: the economic buyer who signs, the technical evaluator who can kill it, the champion who wants it, and procurement, who arrives last and asks about renewal terms. The discovery mechanics in this guide are identical for all four. The difficulty is not. A CEO's name and title are published on the company's own website, while a director of revenue operations three levels down usually is not, which makes the professional network the identity layer for everyone below the executive team.
Quick Summary
Q: Should you target the CEO or someone else?
A: Target the CEO when the company is small enough that the CEO is the buyer, roughly under a hundred people. Above that, Gartner's six-to-ten buying group means you are mapping roles rather than finding one address: economic buyer, technical evaluator, champion, procurement. The discovery methods are the same for all of them, but named executives are published on company websites while mid-level roles usually are not.
Where does a company publish its leadership contact information?
More places than most people check, and almost all of them are free.
There are four classes of source, and they are worth separating because they fail differently. The company's own site is the first. The leadership page, the about us page, and the team page carry names, exact titles, and often photographs, and on smaller companies they sometimes carry a direct address. What they reliably carry, even when they publish no addresses at all, is the exact legal spelling of a name and the precise title. Both matter later.
Press releases are the second, and they are underused. A press release footer almost always names a real human media contact with a working email address. That contact is often the executive assistant or a communications lead, which means you now have a live example of the company's email pattern and a person whose job includes routing inbound requests to leadership. Investor relations pages do the same job on public companies, usually with a phone number attached.
The third class is filings. In the United States, EDGAR filings name corporate officers and carry the company's registered contact details. State business registries list registered agents and officers for private companies. Professional licensing boards publish practitioner names, license status, and often a business address and phone. None of this is scraped from anywhere shady. It is a public record because a regulator required it.
The fourth is the industry layer: association member directories, conference speaker pages, and exhibitor listings. A speaker page routinely carries a bio, a title, an organisation, and sometimes a direct contact for booking purposes. Conference exhibitor listings carry direct dials more often than anyone expects, because the exhibitor wants to be called.
Search operators that actually work
You do not need a tool to interrogate these sources. You need six lines.
# Find the leadership page
site:company.com (leadership OR "executive team" OR "board of directors")
# Surface any address published anywhere on the company's own domain
site:company.com "@company.com"
# Find addresses inside documents the company published itself
site:company.com filetype:pdf "@company.com"
# Press release and investor relations footers, which carry real named contacts
site:company.com ("media contact" OR "press contact" OR "investor relations")
# The person across the open web, minus the noisy sources
"Jane Doe" "Acme Corp" (email OR contact) -site:linkedin.com
# Officers of US public companies
site:sec.gov "Acme Corp" "Chief Executive Officer"The `filetype:pdf` line is the one people skip, and it is often the one that works. Companies publish annual reports, conference decks, and case studies that contain internal email addresses nobody thought to redact.
Note
What the leadership page will not give you. A CEO's direct inbox is almost never published, and if you go looking for it as your only goal you will conclude the page was useless. It was not. It gave you the exact name, the exact title, and, through the press footer, the domain's email pattern. Those three things are the input to everything below.
Quick Summary
Q: Where does a company publish leadership contact information?
A: Four places. Its own site, meaning the leadership, about us, and team pages plus press release and investor relations footers. Its filings, meaning EDGAR for US public companies and state business registries for private ones. Regulatory sources such as professional licensing boards. And the industry layer of association directories and conference speaker or exhibitor listings. Direct executive addresses are rare on all of them, but names, exact titles, and the company's email pattern are not.
Email pattern inference, and the mistake that makes it useless
Corporate email follows a small number of formats. Confirm one address on a domain and you have usually confirmed the rule for everyone on it.
first.last@company.com jane.doe@acme.com most common at mid and large companies
firstlast@company.com janedoe@acme.com
flast@company.com jdoe@acme.com
first@company.com jane@acme.com common under 100 people
first_last@company.com jane_doe@acme.com
lastf@company.com doej@acme.comCompany size tends to predict the pattern. Under a hundred people, `first@` is live more often than you would expect. Above that, `first.last@` dominates, because it survives having two people named Jane.
Note
Inference is not discovery. Generating all six candidates and mailing every one of them is not coverage. It is five guaranteed bounces per contact, and bounce rate is the primary input to your sending domain's reputation. A campaign that "found" four hundred addresses this way can burn the domain your whole team sends from. Infer one address, test it, then send.
Quick Summary
Q: How do you work out a company's email format?
A: Find one confirmed address on the domain, usually from a press release footer, an investor relations page, or a PDF the company published, then read the pattern off it. Six formats cover almost everything, and company size tends to predict which one: `first@` is common under a hundred people, `first.last@` dominates above that. Never send to multiple guessed variants of the same person.
How do you verify an email address before you send to it?
This is the step every guide names and none explains, so here is what a verification tool is actually doing when it hands you a green tick.
1. Syntax check is it a valid address under RFC 5322?
2. Domain / MX lookup dig MX acme.com does the domain accept mail at all?
3. Role-account filter info@, sales@, hello@, careers@ drop or flag these
4. SMTP handshake RCPT TO:<jane.doe@acme.com>
250 = accepted 550 = no such mailbox
5. Catch-all probe RCPT TO:<zzq7f3x9@acme.com>
250 here means the domain accepts EVERYTHING
which means step 4's 250 told you nothing
Steps one through four are what most tools run. Step five is the one that decides whether the result means anything.
A catch-all, or accept-all, domain is configured to accept mail addressed to any local part and sort it out later. On a domain like that, the server returns the same 250 for `jane.doe@acme.com` and for a string of random characters. Roughly four in ten enterprise domains are configured this way. If a tool reports "verified" on an accept-all domain without telling you it is accept-all, it has handed you a false positive dressed as a confirmation.
Note
Around 4 in 10 enterprise domains return an accept-all status to standard SMTP verification, which means the verification result carries no information about whether that specific mailbox exists.
There is no clever trick that defeats this, because the information is genuinely not available over SMTP. What works is corroboration and staging. Confirm the address against a second independent source rather than a second run of the same check. Score the inferred pattern against other addresses you have already confirmed on the same domain, because a pattern that has held for six people is a much stronger signal than a handshake that cannot fail. Keep accept-all addresses in their own segment rather than mixing them into the main send, and put that segment behind a warmed secondary domain so a wrong guess costs you a sending reputation you can afford to lose.
Quick Summary
Q: How do you verify an email address before sending to it?
A: Run five steps: syntax, MX lookup, role-account filter, SMTP handshake, and a catch-all probe. The catch-all probe is the one that matters. Roughly four in ten enterprise domains accept mail to any address, so the handshake returns success for a real mailbox and for random noise alike. On those domains, corroborate the address against a second independent source and send from a warmed secondary domain first.
How do you find a CEO's phone number, and which number is it?
"Phone number" hides three different assets with three different problems.
The switchboard is published, easy to find, and useless on its own. It becomes useful the moment you pair it with an exact name and an exact title, which is what the leadership page gave you. A receptionist who is asked for "the CEO" is a gatekeeper. A receptionist who is asked to put you through to a named person with a correctly stated title is doing their job.
The direct dial is rarely published on a website and turns up more often in filings, investor materials, and conference exhibitor listings than people expect. An exhibitor listing exists so that buyers will call.
The mobile number is almost never public. It is the highest-value number, the fastest to go stale, and the one that carries the most legal exposure to use, which is a combination worth taking seriously rather than celebrating.
| Number type | Where it comes from | Typically published? | Decay | Legal surface |
|---|---|---|---|---|
| Switchboard | Company website, directories | Almost always | Very low | Minimal |
| Direct dial | Filings, investor materials, conference and exhibitor listings, data providers | Rarely | Higher than email | TCPA applies. Personal data under GDPR |
| Mobile | Data providers, occasionally professional profiles | Almost never | Highest | TCPA autodialer restrictions, state DNC laws, personal data under GDPR |
Phone data also ages faster than email. In a study tracking a thousand business contacts over twelve months, 42.9% saw a phone number change against 37.3% for email addresses, and 65.8% changed job title or function. A phone list has a shorter shelf life than an email list built on the same day.
Note
You cannot infer a phone number. There is no `firstname.lastname` equivalent for extensions. Guessing a number does not produce a candidate to test, it produces a wrong number, and the legal treatment of calling it is not softened by the fact that you were guessing. Phone numbers are found or they are not.
Quick Summary
Q: How do you find a CEO's direct phone number?
A: Decide which number you actually need first. Switchboard numbers are published and work when you pair them with an exact name and title. Direct dials appear in regulatory filings, investor materials, and conference exhibitor listings more often than on websites. Mobile numbers are almost never public and carry the most legal exposure. Unlike email, none of them can be inferred from a pattern.
When does it make sense to buy a list or subscribe to a database?
Somewhere between ten and five hundred contacts, the manual route stops paying for itself. Fully verified, a single contact realistically costs you ten to fifteen minutes end to end. A hundred of them is around two working days, and the decay rate means you will be doing it again before the year is out.
This is the tier where a sales intelligence subscription earns its cost, and it is worth being precise about what you are buying. A subscription and a purchased CSV are not the same product. The subscription re-verifies on a cadence. The CSV starts decaying the moment it is exported and never recovers. That difference matters more than any feature comparison.
Note
A typical B2B contact database loses about 2.1% of its records every month, compounding to roughly 22.5% a year. A static purchased list is a depreciating asset from the day it lands in your inbox.
Evaluate providers on the only number that describes your situation. Take your real target-account list, run it against a trial, and measure the match rate on those specific accounts. Vendors quote total record counts because total record counts are large. A two-hundred-million-record database that covers 30% of your target universe is worse for you than a twenty-million-record one that covers 80% of it, and you cannot tell which is which from a marketing page. If you are working through that evaluation properly, our guide to selecting a B2B data provider walks the criteria in more detail, and where the gap sits in records you already hold rather than in the names themselves, that is an enrichment question rather than a discovery one.
Note
A bad list does not fail neutrally. Unverified addresses bounce, bounces damage sender reputation, and sender reputation is shared across everything your team sends from that domain. The cost of a cheap list is not the price of the list.
Quick Summary
Q: Should you buy a CEO email list or subscribe to a database?
A: Subscribe rather than buy a static list, because the subscription re-verifies and the CSV does not. Contact data decays at roughly 22.5% a year, so an exported list is a depreciating asset. Evaluate any provider by running your real target accounts against a trial and measuring the match rate on those accounts, not by comparing total database size.
What changes when you need thousands of contacts, refreshed?
At the third tier the question changes shape. You are no longer asking where to find a contact. You are asking what pipeline produces this universe every month.
That pipeline has five layers, and it is worth seeing them, because it explains why off-the-shelf databases have the coverage gaps they have.
The source layer is the crawl: leadership pages, filings, registries, licensing boards, association directories, press and conference sources, revisited on a schedule. The extraction layer pulls name, title, tenure, and any published contact out of pages that share no common structure, which is the part that looks easy in a demo and stops being easy at the fiftieth site template.
The entity resolution layer is where home-built pipelines usually fail. One person appears as Jane Doe, J. Doe, and Jane A. Doe, at Acme Corp, Acme Corporation, and the subsidiary Acme acquired last year, with two titles that changed in between. Deciding that those records are one human is a harder engineering job than the crawling, and getting it wrong shows up downstream as duplicate outreach to the same person.
The inference and verification layer derives patterns and runs the five-step check from earlier, attaching a confidence score rather than a binary flag. The refresh loop re-crawls, re-verifies, diffs against the last run, and flags what changed.
Note
Email decay reached 3.6% in a single month in November 2024, against a long-run monthly baseline of 1.5% to 2.0%. The refresh loop is not maintenance overhead. It is the part that keeps the other four layers worth running.
Which leaves a genuine three-way decision. Building it in house means owning crawler maintenance, entity resolution, and a verification stack indefinitely, which is reasonable if contact data is core to your product and unreasonable if it is an input to your sales team. Buying means accepting someone else's decisions about which universe is worth covering, which is fine when your ICP sits inside a well-covered segment and painful when it does not. A managed extraction engagement means specifying the universe and the cadence and receiving the output, with the maintenance burden sitting elsewhere. The honest test is the match-rate test from the previous section. If a subscription covers 80% of your target universe, build nothing. If it covers 30%, the missing 70% is the whole question, and no amount of subscription tuning answers it.
This is the layer Forage AI works in. We are not a contact database, and this is not the place to pretend otherwise. We build the company and contact data extraction pipelines that sit underneath a dataset, for teams whose target universe is not well covered by anything off the shelf. The same argument runs one level up at the company layer, where real-time firmographic extraction beats licensing a static database for exactly the same reason.
Quick Summary
Q: What changes when you need thousands of decision-maker contacts?
A: The work becomes a pipeline rather than a search. Five layers: crawling defined public sources, extracting name and title and contact from inconsistent page structures, resolving one person across name and company variants, inferring and verifying addresses with a confidence score, and a refresh loop that diffs each run against the last. Entity resolution is where most in-house builds fail.
Which approach fits your volume
| You need | What actually works | Cost shape | Where it breaks |
|---|---|---|---|
| 1 to 10 contacts | Company sources, search operators, pattern inference, manual verification | Your time, roughly 10 to 15 minutes per verified contact | Around 20 to 30 contacts, or the first time you have to redo the work |
| 10 to 500, refreshed occasionally | Sales intelligence subscription, enrichment on records you already hold | Per seat or per credit | ICP coverage gaps, accept-all domains, the quarter your universe stops matching the vendor's |
| 500 or more, on a cadence | Extraction pipeline over defined public sources, with entity resolution and a re-verification loop | Build cost or a managed engagement | Only when the source universe is genuinely undefined |
Is it legal to find and use a CEO's email address and phone number?
Finding published information and using it for outreach are two different legal questions, and most guides on this topic answer only the first.
Start with the data type, because it decides everything after it. A role account such as `info@company.com` does not identify a natural person and generally sits outside the GDPR definition of personal data. A named mailbox such as `jane.doe@company.com` does identify a person, and so does an employee's work direct dial. There is no business-to-business exemption that makes those two the same thing.
In the EU and UK, the working lawful basis for B2B outreach is legitimate interest under Article 6(1)(f). The Information Commissioner's Office frames this as a three-part test: purpose, necessity, and balancing, all three satisfied before the processing starts. A documented Legitimate Interest Assessment is the evidence that you did it. Read the wording of the regulation carefully: direct marketing may be a legitimate interest, which is not the same as saying it always is.
In the US, email is governed by CAN-SPAM, which wants accurate headers, a real physical postal address, and a working opt-out that you honour promptly. Phone is where the misconception lives.
Note
The B2B exemption is narrower than people think. Most business-to-business calls are exempt from the National Do Not Call Registry provisions of the FTC's Telemarketing Sales Rule. That exemption does not extend to the TCPA, and it does not extend to state do-not-call laws. Both still apply to a call placed to a decision maker's mobile.
Under the TCPA, a live manually dialled call to a wireless number is permitted, while an automated dialler calling that same number needs prior express consent. Statutory damages run at $500 per violation and $1,500 for wilful ones. Where the Telemarketing Sales Rule does apply, the FTC requires that registry data be no older than 31 days, purging newly registered numbers every 31 days. Civil penalties under the Rule reach $53,088 per violation as of the 2025 inflation adjustment, and that ceiling is per call.
| Data type | US email | US phone | EU and UK |
|---|---|---|---|
| Role account such as `info@` | CAN-SPAM applies | Not applicable | Generally not personal data |
| Named work email | CAN-SPAM: accurate headers, postal address, working opt-out | Not applicable | Personal data. Article 6(1)(f) plus a documented LIA |
| Work direct dial | Not applicable | TCPA applies. Federal DNC largely exempt for B2B, state laws may not be | Personal data. LIA plus PECR rules on the channel |
| Personal mobile | Not applicable | TCPA autodialer consent, state DNC, highest exposure | Personal data. Hardest to justify under the balancing test |
The collection side is a separate question again, and it turns on how the data was gathered rather than on what it says. We cover that ground in our guide to the legality of collecting public web data.
This is a summary of how these regimes work as of September 2026, not legal advice. Check your specific jurisdiction and channel mix with counsel.
Quick Summary
Q: Is it legal to find and use a CEO's email address and phone number?
A: Generally yes for B2B outreach, with conditions that vary by data type and jurisdiction. In the EU and UK a named work email is personal data and needs legitimate interest under Article 6(1)(f) plus a documented assessment. In the US, CAN-SPAM governs email while the TCPA governs calls, and the common belief that B2B calling is exempt from everything is wrong. The DNC exemption does not cover the TCPA or state law.
Contact data is a depreciating asset, so budget for that
Every method above produces a snapshot, and the snapshot starts aging on the day you take it.
The fields do not age at the same rate, which means one blanket refresh is the wrong design. Over twelve months, in a study tracking a thousand business contacts, 70.8% saw at least one change: 65.8% changed job title or function, 42.9% changed a phone number, and 37.3% changed an email address.
| Field | Observed 12-month change rate | Practical refresh cadence |
|---|---|---|
| Job title or function | 65.8% | Monthly |
| Phone number | 42.9% | Quarterly, and before any calling campaign |
| Email address | 37.3% | Quarterly, and re-verify immediately before send |
| Company or employer | Varies by sector | Monthly for high-growth segments |
Re-verify before a campaign rather than on a calendar, because the calendar refresh always lands two weeks before or after the moment you actually needed it. And treat a title change as a signal rather than a defect. Someone who moved into the role you sell to last month is a better prospect than they were last quarter, which is the one part of data decay that works in your favour.
Quick Summary
Q: How often should you refresh decision-maker contact data?
A: Per field, not per record. Titles change fastest at roughly 65.8% over twelve months, so refresh those monthly. Phone numbers and email addresses change at 42.9% and 37.3%, so quarterly works, with a re-verification pass immediately before any campaign. Treat title changes as buying signals rather than as errors to correct.
The part that actually decides this
Contact discovery is not a task you complete. It is a cadence you run, and the teams that get it right are the ones that worked out early which tier they were in and stopped paying manual-tier costs for program-tier volume.
The failure mode is almost never picking the wrong method. It is picking a method that was correct at ten contacts and staying with it at four hundred, then blaming the data when the campaign underperforms. If you are spending two days a month on lookups, you are in the second tier and paying first-tier prices. If your subscription matches 30% of your target accounts and you are working around the gap by hand, you are in the third tier and have not admitted it yet.
Run the match-rate test on your real account list. It answers the question faster than any comparison table, including the one above.
If your target universe is the kind that off-the-shelf databases cover poorly, that is the conversation we have most often. Talk to our team about what building the acquisition layer for it would involve.
Frequently asked questions
How can I find a CEO's email address for free?
Start with the company's own sources. The leadership or about us page gives you the exact name and title. A press release footer or investor relations page usually gives you a real working address on the same domain, which reveals the email pattern. Apply that pattern to the CEO's name, then verify before sending. Search operators like `site:company.com "@company.com"` and `site:company.com filetype:pdf "@company.com"` surface published addresses the site navigation does not. This works well for one contact and stops being viable somewhere around twenty or thirty.
Is it legal to find and use a CEO's email address and phone number?
For B2B outreach, generally yes, with conditions. A named work email address is personal data in the EU and UK, so you need legitimate interest under Article 6(1)(f) and a documented Legitimate Interest Assessment. In the US, CAN-SPAM governs email and the TCPA governs calls. The commonly held belief that B2B calling is exempt from everything is wrong: most B2B calls are exempt from the federal Do Not Call Registry provisions, but not from the TCPA or from state do-not-call laws.
How do I find a CEO's direct phone number rather than the switchboard?
Direct dials appear in regulatory filings, investor materials, and conference exhibitor listings more often than on company websites, because an exhibitor wants to be called. Failing that, the switchboard paired with an exact name and exact title is a working route. Unlike email, a phone number cannot be inferred from a pattern, so guessing produces a wrong number rather than a candidate worth testing.
Why do verified email addresses still bounce?
Usually because the domain is configured as accept-all. On those domains, roughly four in ten enterprise domains, the mail server returns the same success code for a real mailbox and for a random string, so the SMTP check that produced the "verified" flag could not have failed. Corroborate against a second independent source and stage those addresses behind a warmed secondary sending domain.
Should I buy a CEO email list?
A static purchased list starts decaying the day it is exported and never re-verifies, and contact data loses roughly 22.5% of its accuracy a year. A subscription that re-verifies on a cadence is a different product and usually the better call. Whichever you choose, evaluate it by running your real target accounts against a trial and measuring the match rate on those accounts rather than comparing total database sizes.
How often should I refresh decision-maker contact data?
Per field. Titles change fastest, around 65.8% over twelve months, so monthly. Phone numbers at 42.9% and email addresses at 37.3% suit a quarterly cadence, with a re-verification pass immediately before any campaign rather than on a fixed calendar date.
Related Articles
- The Complete Guide to Selecting Your B2B Data Provider: the evaluation criteria, vendor comparison framework, and red flags when choosing a contact-data vendor
- Best B2B Data Enrichment Tools: how enrichment tools compare on coverage, freshness, and match rates
- Firmographic Data Sourcing: Why Real-Time Extraction Beats Static Databases: the same build-versus-buy argument at the company-data layer
- Is Web Scraping Legal? What Data Laws Mean for Your Pipeline: the legal position on collecting public web data