Boss Scam
Why in News?
The "Boss Scam" (also known as CEO impersonation fraud) is in the news because India’s capital markets regulator, the Securities and Exchange Board of India (SEBI), officially issued an urgent national advisory on July 17, 2026.
Mechanics: How It Operates?
- The Target: Scammers primarily target finance executives, junior accountants, and HR personnel who handle bank transactions.
- The Impersonation: Fraudsters use social media channels like LinkedIn to map a company's hierarchy and impersonate the CEO, Managing Director (MD), or Board Members.
- The Channels: Phishing and malicious instructions are deployed over everyday communication platforms, including WhatsApp, Microsoft Teams, and corporate emails.
- The Psychological Bait: Attackers create an intense sense of immediate urgency and demand absolute confidentiality, often claiming the transaction relates to a secret business deal or critical regulatory compliance.
Modus Operandi (Method 1): AI Deepfakes & Voice Cloning
- Synthesized Identity: Criminals utilize specialized AI tools to clone the voice or create video deepfakes of top executives.
- Live Deception: They initiate audio/video calls or form fake corporate chat groups where the employee firmly believes they are interacting with their actual boss.
Modus Operandi (Method 2): WhatsApp Web Session Hijacking
- Initial Compromise: Scammers send an urgent message to a senior official (often pretending to be a regulator like the RBI) containing a compressed .ZIP file or a bad link masked as a security update.
- Token Stealing: Opening the file installs a Trojan horse on the executive's Windows system, which covertly hijacks their active WhatsApp Web tokens.
- Authentic Account Exploitation: Because hackers gain full access to the boss's real WhatsApp account, they message subordinate employees directly from it, bypassing standard security flags.
- Contact Manipulation: In severe cases, hackers take over the device directory and quietly switch phone numbers under the CEO's name to sustain the deception.
The End Objective
- Mule Accounts: Employees are ordered to bypass standard verification protocols to transfer funds immediately to specified mule bank accounts.
- Immediate Laundering: Once the money hits these proxy accounts, it is rapidly withdrawn or converted to cryptocurrencies, making recovery extremely difficult.
Official Safety Guidelines and Defences
- Mandatory Call-Backs: Never authorize payment requests solely based on text or chat; always call the executive on an established, official voice channel to verify.
- Session Management: Corporate systems should strictly enforce auto-logout parameters for WhatsApp Web and external messaging platforms when idle.
- File Restrictions: Train personnel to block down-loading of unsolicited or unknown .ZIP and .EXE files across business endpoints.
- Emergency Reporting: If a breach occurs, victims are urged to immediately alert their bank to freeze funds and file a formal case via the National Cyber Crime Portal (cybercrime.gov.in) or call the emergency helpline at 1930.
