SEBI flags ‘Boss Scam’ that targets C-suite officials

Market regulator Securities and Exchange Board of India (SEBI) has cautioned regulated entities and listed firms against “Boss Scam”, wherein fraudsters impersonate as chief executives or other senior officials to trick finance teams into transferring funds

“The communication through email/ WhatsApp/Microsoft Teams/other social media platforms with their subordinates or counterparts, directs them to carry out instructions given to them resulting in transfer of funds to fraudsters,” SEBI said in a statement.

Outlining two methods, SEBI said fraudsters impersonate senior executives and send messages or make calls directing subordinates to urgently transfer money to specified bank accounts. In some cases, fraudsters use artificial intelligence tools such as voice cloning and deepfake video calls to make the impersonation appear genuine.

Another method, according to SEBI, was the fraudsters send a compressed ZIP file containing malicious software. Once the file is opened on a Windows device, the malware hijacks active WhatsApp Web sessions, allowing fraudsters to gain access to the victim’s account and send payment instructions to finance or accounts personnel.

“Alternatively, if the fraudster achieves complete device takeover, they secretly alter the contact list on the device, and saves the fraudster’s phone number under the name of the CEO/MD and use that secondary number to instruct finance officer into transferring funds,” SEBI said. 

The market regulator alerted corporate professionals to “remain cautious and cross-check requests received through WhatsApp/ email/ social media platforms, by calling their seniors.”

Advising people “not to transfer funds solely on the basis of instructions received on any social media platforms.”, SEBI asked the professionals to close their Whatsapp sessions on their computers after use and not install files without verifying the identity of the sender.

The advisory follows an alert from the Indian Cyber Crime Coordination Centre (I4C), which has flagged a rise in CEO/MD impersonation fraud targeting organisations through various social media platforms.