Boss Scam Explained: How fraudsters can make a fake CEO look real and how to avoid it

If you receive an email or WhatsApp message from your boss or CEO asking you to urgently transfer a large sum of money to a new bank account, what should you do? The message may appear to come from the CEO’s actual account. You recognise the name, profile picture and messaging account, so you assume the request is genuine. That is precisely how the 'Boss Scam' works. Fraudsters are now increasingly impersonating CEOs, managing directors, and other senior executives to trick employees, especially finance teams, into transferring money or sharing sensitive information. 

Market regulator Securities and Exchange Board of India (SEBI) has recently warned regulated entities and listed companies about this emerging cyber fraud after the Indian Cyber Crime Coordination Centre (I4C) flagged the trend. 

What is the Boss Scam? 

The Boss Scam is a form of CEO or MD impersonation fraud in which criminals pose as senior executives and contact their employees through WhatsApp, email, Microsoft Teams or other social media and messaging platforms. 

The impersonator then issues instructions, often involving an urgent payment, which the employee follows believing that the request has come from a trusted senior. The regulator has cautioned that such communications can ultimately result in funds being transferred to accounts controlled by fraudsters. 

How do fraudsters impersonate a CEO or senior executive? 

Criminals are using increasingly sophisticated methods to make their impersonation appear genuine. 

According to SEBI, one method involves deepfake technology, including, voice cloning to imitate a senior executive, AI-generated video calls that make it appear as though the CEO or MD is speaking directly to an employee, and fake groups or profiles on social media platforms created in the name of senior officials. 

These techniques can make traditional checks, such as recognising a familiar face or voice, less reliable. 

How does a fake instruction turn into a real financial loss? 

Once the fraudster establishes contact, the employee may receive instructions to transfer funds to a specified bank account, often a mule account controlled by the criminals. The request may be accompanied by pressure to act immediately. In some cases, the employee may also be told not to disclose the transaction because it supposedly involves confidential or unpublished price-sensitive information. 

The instructions may be delivered through messages, fake calls or social media platforms. 

How can a malicious ZIP file compromise WhatsApp? 

The scam can take a more technical route as well. Fraudsters may send a compressed .zip archive containing a malicious executable file along with a Dynamic Link Library (DLL) file. 

If the recipient extracts and executes the file on a Windows computer, it can activate a Trojan dropper. The malware can compromise the system and hijack active WhatsApp Web session tokens. Once the session is compromised, the fraudster may gain access to the finance officer’s WhatsApp account and use it to contact other employees. 

What happens after a WhatsApp account is hijacked? 

The fraudster can use the compromised account to impersonate a trusted colleague or senior executive and instruct other finance employees to make immediate payments to specified mule accounts. 

In another scenario, if the attacker gains extensive control of the device, they may secretly modify the contact list and save their own phone number under the CEO’s or MD’s name. The finance employee may then receive a call or message from what appears to be the executive’s number and act on the fraudulent instruction. 

Why is the Boss Scam particularly dangerous? 

The scam exploits one of the most powerful instincts in the workplace, trust in authority. An unexpected payment request from an unknown person may immediately raise red flags. But when the same request appears to come from the CEO, MD or another senior executive, especially through a familiar account, employees may be less likely to question it. 

AI-generated voices and videos, compromised messaging accounts, and fake profiles can make the deception even harder to detect. 

What should employees do if they receive an urgent payment request? 

Stop and verify. Employees should not transfer funds solely because an instruction arrives through WhatsApp, email, Microsoft Teams or another social platform. 

Instead, they should independently contact the executive using a known and trusted phone number and confirm the request. 

A message saying 'urgent', combined with a request to use a new bank account or keep the transaction confidential, should be treated as a major warning sign. 

Should employees open files received from a known contact? 

Not without verification. Even if a file appears to have been sent by a known person, employees should verify the sender before opening or installing executable files. 

A compromised account can allow a fraudster to send malicious files while appearing to be a trusted colleague. 

How can companies reduce the risk? 

SEBI has advised regulated entities and listed companies to exercise caution when responding to instructions received through WhatsApp, email or other social media platforms. Any request involving the transfer of funds should be independently verified by calling the concerned senior executive directly, rather than relying solely on a message or online communication. 

Firms should also avoid installing executable files unless the sender’s identity has been verified, even when the file appears to have come from a known contact. Employees should regularly review their active WhatsApp Web sessions and log out of any sessions that are not in use. Any fraudulent application or suspected cybercrime incident should be reported immediately to the authorities. 

Where should victims report a cyber fraud? 

Suspected cyber fraud should be reported immediately through the national cybercrime helpline 1930 or the government’s cybercrime reporting portal at cybercrime.gov.in. 

What is the simplest way to avoid a Boss Scam? 

Do not trust the message. Verify the instruction. A familiar name, profile picture, phone number, or even a seemingly genuine voice or video, is no longer enough to establish that a payment request is real. When a message from the boss asks for money, one phone call could be the difference between a legitimate transaction and a costly cyber fraud.