Got a WhatsApp message from your CEO? SEBI says it could be a ‘Boss Scam’

A WhatsApp message from your CEO asking you to urgently transfer money may look genuine, but SEBI says it could be part of a growing cyber fraud targeting companies across India. The Securities and Exchange Board of India (SEBI) has issued an advisory warning listed companies and regulated entities about the rise of the so-called “Boss Scam” or CEO impersonation fraud.  Also Read: Is WhatsApp's username feature now live? Everything you need to know

The market regulator issued the warning after the Indian Cyber Crime Coordination Centre (I4C) reported an increase in such incidents. According to SEBI, fraudsters are posing as senior company executives, including CEOs and Managing Directors, and contacting finance or accounts employees through WhatsApp, email and other social media platforms. The messages usually create a sense of urgency and ask employees to transfer company funds to bank accounts controlled by the attackers.  Also Read: WhatsApp is rolling out iPhone Mic Mode controls; Here's what changes during calls

How the scam works 

SEBI says cybercriminals are mainly relying on two methods to carry out the fraud. The first involves artificial intelligence. Fraudsters use AI-generated voice cloning, deepfake video calls and fake WhatsApp or social media profiles to convince employees they are speaking to a senior executive. Once employees are convinced they are talking to a senior executive, they are asked to transfer funds to a specified bank account without delay.  Also Read: Swiggy Instamart partners with HPCL to deliver LPG cylinders at customers' doorsteps

In many cases, attackers say the payment is connected to Unpublished Price Sensitive Information (UPSI) or another confidential business deal. Employees are told to keep the transaction secret, which prevents them from checking with colleagues or other senior officials before transferring the money. 

The second method uses malware. According to SEBI, attackers send a compressed .zip file containing a malicious executable file and a Dynamic Link Library (DLL) file. If the file is opened on a Windows computer, it installs malware that can take over an active WhatsApp Web session. Once they gain access, fraudsters can send payment instructions from the employee’s WhatsApp account, making the messages appear legitimate. In some cases, attackers who manage to compromise a device also save their own phone number under the CEO’s or MD’s name in the contact list before sending fake payment requests. 

What SEBI has advised 

SEBI has asked organisations not to rely only on WhatsApp, email or social media messages when approving financial transactions. Instead, employees should always verify payment requests by directly calling the concerned senior executive before transferring any funds. 

The regulator has also advised employees to avoid opening executable files or compressed files received from unknown or unverified sources. SEBI has also advised employees to log out of WhatsApp Web on devices they are no longer using. This can help prevent attackers from taking over an active session if a device is compromised. 

Add Techlusive as a Preferred Source

If you suspect you’ve received one of these messages or have already fallen victim to the scam, SEBI says you should report it without delay. Complaints can be filed by calling the National Cybercrime Helpline on 1930 or through the National Cyber Crime Reporting Portal. Reporting the incident quickly can improve the chances of stopping the transaction and help authorities investigate the case.