Cyber Crime Centre Warns Companies About Rising 'Boss Scam' Threat

The Indian Cyber Crime Coordination Centre (I4C) has issued a fresh advisory warning businesses and organisations about a growing cyber fraud known as the "Boss Scam," in which cybercriminals impersonate senior executives and regulatory authorities to deceive employees into making unauthorised financial transfers. The warning was issued by the National Cybercrime Threat Analytics Unit (NCTAU), a specialised division operating under I4C, amid reports of increasing incidents targeting corporate entities across the country.

According to the advisory, fraudsters typically begin by contacting chief executives, directors and other senior officials through emails or WhatsApp messages disguised as communications from regulatory agencies such as the Reserve Bank of India (RBI). The messages often claim that the organisation has violated regulatory norms or urgently needs to install security-related updates. By creating a sense of urgency and authority, attackers attempt to pressure recipients into acting without proper verification.

The fraudulent messages usually contain a compressed ZIP file that is presented as a compliance document or software update. Once downloaded and executed on a Windows-based computer, the file installs malware that can compromise the victim's device. The malicious software is capable of hijacking active WhatsApp Web sessions, allowing cybercriminals to gain access to genuine WhatsApp accounts belonging to senior company officials.

Also Read: Beware of Fake India Post 'Dak Seva Gifts' Messages Circulating on WhatsApp, Warns Government

After obtaining control of the executive's account, the attackers contact finance and accounts personnel while posing as the executive. Using the trusted communication channel, they issue instructions for urgent fund transfers to bank accounts controlled by the fraudsters. In some cases, cybercriminals reportedly modify contact information on the compromised device, saving their own phone numbers under the names of senior executives to make fraudulent requests appear authentic.

The advisory notes that finance departments are particularly vulnerable because employees are accustomed to processing payment requests from top management. By exploiting trust and organisational hierarchies, attackers can bypass traditional security measures and convince staff to transfer substantial sums of money before the fraud is detected. The technique relies heavily on social engineering rather than technical vulnerabilities alone.

To mitigate the threat, I4C has urged organisations to independently verify all urgent payment requests and account-change instructions through voice calls or in-person confirmation rather than relying solely on messages or emails. The agency also advised users not to install executable files received from unknown or unverified sources, emphasising that regulators such as the RBI do not distribute mandatory software updates through WhatsApp attachments. Additional recommendations include implementing software restriction policies, regularly reviewing linked WhatsApp devices, maintaining updated malware protection systems and promptly reporting incidents through the national cybercrime helpline 1930 or the National Cyber Crime Reporting Portal.

Also Read: Sanju Samson Names MS Dhoni 'Roger Federer Of Cricket', Likens Virat Kohli To Carlos Alcaraz