WhatsApp “Boss Scam”
Why in News?
The Indian Cyber Crime Coordination Centre (I4C) under the Ministry of Home Affairs issued an advisory on 7 August 2026 warning corporates, Chartered Accountants, CFOs, company directors and finance professionals about a rising WhatsApp-based fraud known as the “Boss Scam” or CEO impersonation fraud. Complaints have been reported from Delhi, Gujarat, Maharashtra and Rajasthan.
Modus Operandi
- Victims receive malicious .zip files through WhatsApp, SMS or email, disguised as “Statement of Account.zip”, “RBI.zip” or “MCA.zip”.
- When opened on a Windows computer, the file installs malware that can hijack an active WhatsApp Web session.
- The compromised account automatically circulates the malicious file to contacts and groups.
- Fraudsters then impersonate a CEO or senior executive and issue urgent instructions to finance staff to transfer money to fraudulent or “mule” bank accounts.
- The campaign reportedly uses advanced malware and DLL sideloading, a technique that helps malicious code evade detection.
Recent Example
A Mumbai employee was allegedly induced to transfer ₹1.98 crore after fraudsters used the name and photograph of a company director on WhatsApp. Prompt police intervention reportedly helped secure approximately ₹1.83 crore, or nearly 92% of the transferred amount.
Government Response
A Mumbai employee was allegedly induced to transfer ₹1.98 crore after fraudsters used the name and photograph of a company director on WhatsApp. Prompt police intervention reportedly helped secure approximately ₹1.83 crore, or nearly 92% of the transferred amount.
Government Response
- I4C has shared malware-related technical indicators with CERT-In, Microsoft Defender and cybersecurity firms.
- The Sahyog Portal is being used to block malware linked to the campaign.
- More than 10,000 citizens were reportedly protected, while alerts were sent to over 58,000 potential victims through the SMS header “I4CMHA-G”.
- Victims can report cyber fraud immediately through the National Cyber Crime Helpline 1930 or the National Cyber Crime Reporting Portal.
Significance
- The scam highlights the growing convergence of social engineering, malware, account takeover and financial fraud.
- It also shows that a familiar profile picture or message from a seemingly genuine WhatsApp account cannot be treated as sufficient authentication for financial transactions.
Preventive Measures
- Do not download or extract unknown .zip or executable files.
- Verify urgent payment requests through a direct phone call or in-person confirmation.
- Follow a dual-authorisation system for high-value transfers.
- Regularly check WhatsApp Linked Devices and remove unfamiliar sessions.
- Keep operating systems, browsers and anti-malware software updated.
- Remember that regulators such as the RBI do not send software updates, security patches or account statements through WhatsApp attachments.
