How to impersonate the boss and con the firm

Get 37% off on an annual Print + Digital subscription of India Today Magazine

A WhatsApp message, a stolen identity and a compromised computer are all it takes to steal corporate funds by exploiting an employee's instinctive deference to authority

Welcome to the world of the 'Boss Scam', where cybercriminals do not need to breach a bank's security systems or crack its digital defences; they simply need to fool an employee. In Mumbai, a company lost Rs 48 lakh and another was defrauded of Rs 10 crore. In October, a Chennai company lost Rs 1.9 crore when a WhatsApp message, purportedly from its managing director, prompted an urgent fund transfer. In Pune, an engineering firm lost Rs 30 lakh in an incident reported in August.

The modus operandi is disarmingly simple: an impersonator uses a senior executive's photograph as their WhatsApp display picture, claims to be tied up in an important meeting and instructs an employee to transfer money immediately to a bank account provided in the message. Convinced that the request has come from the boss, the employee complies. The fraudster exploits neither a technical vulnerability in the banking system nor a weakness in its payment gateway, but something far more human: the employee's trust in authority, fear of questioning a superior and the pressure to act without delay.

The two Mumbai investigations have laid bare a disturbing feature of the so-called Boss Scam: the same supply chain of fraudulently activated SIM cards from Bihar providing the infrastructure for successive attacks on companies, allowing criminals to assume the identities of senior executives and siphon off corporate funds.

In February, an accountant at a Mumbai-based pipe company, transferred approximately Rs 48.6 lakh after receiving WhatsApp messages that appeared to come from a company director. Months later, a deputy general manager (accounts) of another group made 63 transfers totalling over Rs 10 crore after a fraudster messaged him on WhatsApp impersonating a senior director. Convinced that he was acting on the instructions of his superior, the employee authorised the payments. The fraud came to light only when he sought invoices from the actual director.

In mid-August, Mumbai's South Cyber Police arrested two men accused of supplying the SIM cards used in these and other frauds: Aamir (also spelt Amir) Chand Mohammad Khan, an Airtel point-of-sale vendor from Siwan in Bihar, and his alleged associate, Suraj Kumar Pradeep Kumar Saw, also known as Vishal, from the Dhanbad-Jamtara region of Jharkhand. According to the police, Khan obtained an army personnel's e-KYC documents when the soldier approached him to port an existing number. He allegedly activated a SIM using those documents and subsequently told the soldier that the activation had failed. The SIM was then allegedly passed on and used by fraudsters. Investigators seized 161 SIM cards from the duo.

The arrests expose the human infrastructure underpinning the Boss Scam: criminals appropriate the authority of senior executives to induce employees to transfer company money. In accounts departments, where speed and compliance are often prized, a message bearing the boss's name and photograph can acquire an air of authenticity before anyone stops to question its provenance.

THE CRIME BEGINS WITH A MESSAGE

The Boss Scam is a targeted form of cyber fraud in which criminals impersonate a chief executive, managing director or another senior official to induce subordinates to transfer funds. It belongs to the wider family of business email compromise and executive impersonation attacks, in which the authority of a trusted individual becomes the instrument of financial deception.

The approach may come through email, WhatsApp, Microsoft Teams or another workplace communication platform. The request often appears plausible: the boss is in a meeting, a confidential transaction must be completed, or a payment cannot wait until the following day. An account number is supplied, a deadline imposed and an employee urged to act without delay. Urgency suppresses scrutiny; hierarchy inhibits dissent.

The mechanics of impersonation are deceptively easy. A profile photograph can be copied, a name reproduced and a message composed to resemble the executive's usual style. On Teams, a fraudulent profile can exploit the familiarity of a corporate environment; on WhatsApp, a photograph displayed beside an unfamiliar number may be enough to create misplaced confidence.

The crucial distinction is one employees could easily overlook: recognising an identity is not the same as authenticating it.

WHEN THE BOSS'S COMPUTER BECOMES THE WEAPON

The threat becomes considerably more insidious when impersonation is combined with malware. On June 22, the National Cybercrime Threat Analytics Unit of the Indian Cyber Crime Coordination Centre (I4C), under the Ministry of Home Affairs, issued a specific advisory on regulatory and executive impersonation leading to WhatsApp account takeovers and high-value financial fraud.

The advisory describes a carefully engineered deception. A fraudster contacts a senior executive while impersonating a regulator such as the Reserve Bank of India, alleges an urgent compliance violation or security deficiency, and demands immediate action. The message carries a compressed ZIP archive containing a malicious Windows executable file (.exe) alongside a Dynamic Link Library (.dll).

If the executive extracts and runs the file on a Windows computer, then a Trojan can be installed. The malware establishes a persistent presence on the device and hijacks active WhatsApp Web session tokens, enabling the attacker to exploit the executive's genuine WhatsApp account.

The fraudster can then contact finance personnel in the executive's name, instructing them to transfer funds to designated bank accounts, often controlled by intermediaries known as 'money mules'. To the recipient, the instruction appears to have come from the actual executive through an authentic account. The deception is therefore more difficult to detect than a message sent from an obviously unfamiliar number.

I4C also identifies an alternative method: an attacker who gains sufficient control of a device can covertly save an attacker-controlled number in the contact list under the CEO's name. Subsequent payment instructions appear to originate from the boss, although the number itself is fraudulent.

THE SIM SUPPLY CHAIN

The Mumbai investigations underline how a digital deception can depend on a physical supply chain. The alleged misuse of an army personnel's e-KYC documents points to the potential role of compromised identity verification and SIM activation in creating the appearance of a legitimate WhatsApp identity.

The arrests in Bihar and Jharkhand do not establish that either state is a centre of the Boss Scam. They do, however, raise a pertinent question: who supplies the identities, communication channels and bank accounts that enable such frauds to operate across state borders?

A fraudulently activated SIM can provide the means to impersonate an executive; a mule account can receive the proceeds; and other intermediaries may move or withdraw the money. The person who sends the initial message may have little direct contact with the person who ultimately benefits. Establishing the links among these participants is essential to determining whether apparently separate incidents form part of a coordinated criminal network.

WHY TECHNOLOGY ALONE CANNOT STOP IT

The most effective safeguard may be procedural rather than technological. No urgent financial instruction should be acted upon solely because it arrives through a familiar messaging platform. Confirmation through a direct voice call to a previously verified number, or in person, can expose an impersonation attempt. Large or unusual transfers should require independent, secondary authorisation.

Equally important is the organisational culture in which these controls operate. Employees must be able to question an instruction from a senior executive without being made to feel they are obstructing business. In a robust financial control system, verification is not an expression of mistrust; it is a professional obligation.

The Mumbai cases also demonstrate why the recovery of money depends on speed. Once funds begin moving through multiple accounts, tracing and freezing them becomes more difficult. Anyone who suspects a fraudulent transfer should report it immediately through India's cybercrime helpline, 1930, or the National Cyber Crime Reporting Portal at cybercrime.gov.in. Prompt reporting can help banks and investigators intervene before the proceeds disappear.

The Boss Scam thrives on a deeply ingrained corporate reflex: the assumption that an instruction from the top must be obeyed. In a digital workplace, a familiar name, a recognisable photograph and a message timed to create urgency can manufacture authority with alarming ease.

The criminal's most consequential achievement may not be breaking into a computer. It is persuading an employee to suspend disbelief. The boss may appear to be real. The account may seem genuine. The instruction may appear entirely plausible. Yet the money could still be flowing to a criminal. The rule for the digital workplace is simple: trust the person, but verify the payment.