Boss Scam
🔹Short Note
Boss Scam : As cyber fraud, popularly known as ‘Boss Scam’ targeting companies and corporate executives across the country is on the rise, market regulator Securities and Exchange Board of India (SEBI) has issued an advisory to listed companies and regulated entities. The latest scam entails cybercriminals impersonating CEOs, Managing Directors (MD), CFOs or other senior executives to direct finance and accounts personnel to execute an immediate funds transfer or to divulge sensitive information. The warning comes after the Indian Cyber Crime Coordination Centre (I4C) observed increased such incidents across India.
🔹Detailed Explanation
Another factor that has led most criminals targeting businesses instead of individual consumers is the large sums of money involved in corporate financial transactions. One of the newer methods being implemented is the Boss Scam (CEO Fraud).
This scam involves fraudsters impersonating senior company officials such as:
- Chief Executive Officer (CEO)
- Managing Director (MD)
- Chief Financial Officer (CFO)
- Chairman
- Senior Finance Head
The criminals typically reach the employees working in the domain of finance, accounts, treasury, payroll or administration like this:
- Microsoft Teams
- SMS
- Social media platforms
- Voice calls
- AI-generated voice cloning
- Deepfake video calls
The fraudster sends a message that is very urgent, for example:
- “Transfer ₹50 lakh immediately.”
- “This is a confidential acquisition.”
- “Don’t discuss this with anyone.”
- “Pay before the bank closes.”
- I was already busy in an important meeting, (Just handle it)
The message pressures you, insisting on secrecy and time. Employees tend to assume it’s real since it looks like a request from the company’s CEO.
SEBI has also said now, criminals have started using Artificial Intelligence (AI) to add authenticity to these scams. Some attackers employ deepfake voice cloning, or AI-generated video calls to mimic the same physical and vocal characteristics of executive leaders. Some create fictitious WhatsApp accounts with the photograph and name of the CEO.
A another variant even rarer but much more dangerous is malware attacks.
Fraudsters email ZIP files or documents falsely purporting to transmit business invoices, audit reports, or other sensitive documentation. When the employee opens the attachment, malware gets installed on this computer.
The malware may:
- Hijack WhatsApp Web sessions
- Access company emails
- Steal login credentials
- Modify saved contact numbers
- Monitor financial communications
- Send payment instructions from real employee accounts
- Since the messages come from real company accounts, colleagues generally trust them and approve payments without raising any alarms.
According to the Indian Cyber Crime Coordination Centre (I4C), finance departments are more susceptible as they usually process high-value transactions and there is sometimes pressure for them to comply quickly with directions from senior management.
Hence, SEBI has asked regulated entities and listed companies to strengthen internal controls and make employees aware of this cyber threat.
🔹How the Scam Works
- The Boss Scam normally goes in this order:
- Fraudsters gather data about corporate executives
- They use fake email addresses or WhatsApp profiles.
- Cloning voices using AI tools or generating artificial video calls, like Sean Parker with a cell phone that the software can control.
- Employees receive urgent payment instructions.
- The conman requires the business to be kept a secret.
- Workers send the company money to mule bank accounts.
- The money is shuttled around between different accounts before the scam is detected.
🔹Example
Lets say the finance manager of a company receives a WhatsApp message showing the picture of the CEO.
The message states:
“I am in a non-disclosure merger negotiation.” Pay this vendor in advance in the name of 75 lakh at this time Keep this to yourself until the deal is done.
Thinking the directive is genuine, the finance manager pays.
The actual CEO then confirms that no such order was ever given. The company finds out that the money was transferred to bank accounts owned by crooks.
In a separate incident, an employee is sent ZIP file labelled “Urgent Audit Docs.” Once opened a malware secretly gains access to the employee’s WhatsApp Web session and sends fictitious payment requests to the finance department.
🔹Key Legal Points
In addition, the following laws may apply depending on the facts of the case:
- Section 420 of the IPC – Cheating and dishonestly inducing delivery of property (or, for offences committed after 1 July 2024, the corresponding provision under Bharatiya Nyaya Sanhita)
- IPC Sections 463–471 — Forgery and use of forged electronic documents.
- IPC Section 120B – Criminal conspiracy
- Relevant Sections of the Information Tech- nology Act, 2000 dealing with Identity theft, phishing, hacking by opening secured Computer systems and cyber frauds
- Every incident should be reported as soon as possible via the Cyber Crime Helpline (1930) and the National Cyber Crime Reporting Portal.
🔹Nyay Neeti Advice
All organizations must have a mandatory check/verification for high-value financial transactions. If it is a payment request via WhatsApp, email, Microsoft Teams or another channel, do not respond before first verifying based on an official communication channel.
Educate employees to recognize phishing emails, impersonation of executives, AI voice calls and deepfake videos. Never open an unknown ZIP file or executable contained in a message and never click on links sent from unknown sources. They must also conduct multi-level payment approvals, enable multi-factor authentication (MFA), regularly audit devices linked with WhatsApp and keep systems updated with the latest security patches.
In case a business notices a Boss Scam, it must cease the transaction (if viable), alert its bank, retain emails, chat messages, call recordings and system logs and report an incident to the Cyber Crime Helpline (1930) at once. The sooner fraud is reported, the greater the opportunities to freeze fraudulent transactions and enable law enforcement agencies to track down the criminals.
