What Is the "Boss Scam"? How Cyber Criminals Are Targeting Indian Companies — SEBI Issues Warning
Cyber fraudsters are no longer targeting individual users alone — their new focus is India's large and listed companies. India's capital markets regulator, SEBI (Securities and Exchange Board of India), has recently warned all listed companies and regulated entities about a highly sophisticated cyber fraud known as the "Boss Scam." This advisory was issued following an alert from the Indian Cyber Crime Coordination Centre (I4C).
What Exactly Is the Boss Scam?
In this scam, cybercriminals steal the identity of a company's CEO, MD, or another senior executive and impersonate them. They contact junior employees or finance teams through email, WhatsApp, Microsoft Teams, or other social media platforms, and use a sense of urgency to pressure staff into transferring funds immediately to a specified bank account.
Fraudsters typically use phrases like "urgent deal," "confidential transaction," or "immediate payment required" to create pressure so the employee doesn't have time to think it through or verify the request.
What Techniques Are Criminals Using?
1. AI Voice Cloning and Deepfake Video Calls
Scammers are no longer limited to text messages. They now use AI-based voice cloning tools to replicate a boss's voice with startling accuracy, and in some cases even use deepfake video calls — making it nearly impossible for the victim to suspect anything is wrong.
2. Hijacking WhatsApp Web via Malware
Criminals send malware-infected ZIP files. When an employee opens the file on a Windows computer, the malware activates and takes over any active WhatsApp Web session on that machine. This gives the attackers full access to the account, allowing them to send payment instructions directly to the finance team as if from a trusted contact.
3. Manipulating Contact Lists
On compromised devices, scammers save their own number under the CEO or MD's name in the contact list, so employees are led to believe the message genuinely came from their boss.
SEBI's Key Advice — How Can Companies Protect Themselves?
Independently verify every request: Never act on financial instructions received via WhatsApp, email, or social media without confirmation. Call the concerned senior official directly to verify before proceeding.
Avoid fund transfers based solely on digital messages: Never transfer funds based only on instructions received through a social media platform.
Don't open unknown files: Never download or open
.exeor.ZIPfiles without confirming the sender's identity.Log out of WhatsApp Web: Make it a habit to immediately log out of WhatsApp Web sessions on office computers once the work is done.
What to Do If You Fall Victim to This Fraud
If your company — or you personally — become a victim of such cyber fraud, don't waste time. Call the National Cyber Crime Helpline at 1930 immediately, or file a complaint on the National Cyber Crime Reporting Portal.
The first few hours after a fraudulent transaction — often called the "golden hour" — are critical. The faster a complaint is filed, the greater the chance of getting the receiving bank account frozen and recovering the funds.
As AI technology becomes more accessible, cybercriminal tactics are becoming increasingly convincing and effective. The "Boss Scam" is a clear reminder that technical security measures alone are no longer enough — employee awareness and strict verification protocols are just as essential.
Companies should regularly train their finance staff to recognize these scams, so that no one falls victim to fraud disguised as urgency.
