MUMBAI: When the boss calls, it may not be the boss at all. That’s the warning from the Securities and Exchange Board of India (SEBI), which has sounded the alarm over a growing cyber fraud in which criminals impersonate senior executives to trick finance teams into transferring company funds.
The market regulator has issued an advisory to listed companies and regulated entities after receiving an alert from the Indian Cyber Crime Coordination Centre (I4C), which has reported an increase in incidents involving the so-called “Boss Scam.”
According to SEBI, fraudsters are posing as Chief Executive Officers (CEOs), Managing Directors (MDs) and other senior company officials through email, WhatsApp, Microsoft Teams and social media platforms. They then contact finance or accounts personnel, instructing them to transfer money to bank accounts controlled by the attackers.
SEBI said the scam is being executed primarily through two methods, both exploiting advances in artificial intelligence and social engineering.
In the first, cybercriminals use AI-powered deepfake videos, voice cloning technology and fake social media groups to convincingly impersonate senior executives. Finance teams are then pressured into transferring funds to mule bank accounts, sometimes under the pretext that the payment relates to unpublished price-sensitive information, discouraging employees from discussing the transaction internally.
The second technique involves distributing a ZIP file containing a malicious executable programme and a Dynamic Link Library (DLL) file. If the files are extracted and run on a Windows desktop or laptop, the malware can hijack an active WhatsApp Web session.
Once they gain access, attackers use the compromised WhatsApp account to send urgent payment instructions to finance personnel. SEBI warned that if fraudsters obtain broader control of the device, they may even alter the contact list by saving their own number under the name of the CEO or Managing Director, making fraudulent requests appear genuine.
To counter the threat, SEBI has advised organisations to independently verify all payment requests received through WhatsApp, email or social media by directly contacting the concerned executive through trusted channels. Companies have also been urged not to authorise fund transfers solely on the basis of digital messages, regardless of how authentic they appear.
The regulator further recommended that employees avoid installing executable files unless the sender’s identity has been independently confirmed, even if the message appears to come from a known contact. It also advised organisations to log out of inactive WhatsApp Web sessions to reduce the risk of unauthorised access.
SEBI has asked entities to report any suspected cyber fraud immediately by calling the National Cybercrime Helpline 1930 or filing a complaint through the National Cyber Crime Reporting Portal.
The advisory reflects growing concern over how artificial intelligence is reshaping cybercrime. As deepfakes, voice cloning and sophisticated malware become increasingly accessible, regulators are urging businesses to treat digital payment requests with greater scrutiny, reinforcing the principle that in today’s cyber landscape, trust should always be verified before money changes hands.