The Securities and Exchange Board of India (SEBI) has sounded the alarm over an emerging cyber fraud known as the ‘Boss Scam’, under which the fraudsters impersonate CEOs, managing directors and other senior executives to trick finance teams into transferring money.
SEBI has issued a cautionary advisory to all regulated entities and listed companies after being alerted by the Indian Cyber Crime Coordination Centre (I4C) about the growing incidence of such scams.
What is the ‘Boss Scam’?
The scam exploits the authority of senior management. Fraudsters impersonate a CEO or MD through emails, WhatsApp messages, Microsoft Teams, video calls or other social media platforms and instruct finance officials or employees to make urgent fund transfers.
According to SEBI, cybercriminals are increasingly relying on artificial intelligence and sophisticated malware to make these impersonation attempts appear genuine.
In the MF industry, fraudsters have impersonated as Kailash Kulkarni, MD & CEO, HSBC Mutual Fund, Nilesh Shah, MD and CEO of Kotak Mahindra AMC, Swarup Mohanty, Vice Chairman & CEO of Mirae Asset Mutual Fund.
How does the fraud work?
SEBI highlighted two common methods being used by scammers.
Deepfake impersonation: Criminals use AI-powered voice cloning, deepfake video calls and fake social media groups to pose as senior executives. Finance officials are then instructed to transfer money to designated bank accounts, often with directions to keep the transaction confidential by claiming it relates to unpublished price sensitive information (UPSI).
Malware through ZIP files: In another method, fraudsters send compressed ZIP files containing malicious executable programs. Once opened, the malware hijacks the victim’s WhatsApp Web session or even takes control of the device. The attackers then use the compromised account or change contact details to make their own number appear as that of the CEO or MD to direct employees to make payments to fraudulent bank accounts.
Why has SEBI stepped in?
The regulator said the advisory follows inputs from I4C, which has observed a growing trend of cybercriminals specifically targeting senior executives and finance personnel at regulated entities and listed companies. The scams ultimately aim to trick organizations into transferring funds to fraudsters.
What companies should do
SEBI has urged companies and market intermediaries to strengthen verification procedures before acting on payment instructions. Specifically, it has advised organizations to:
- Independently verify fund transfer requests received through WhatsApp, email or social media by calling the concerned senior official.
- Never transfer funds solely on the basis of instructions received through messaging or social media platforms.
- Avoid opening executable files or ZIP attachments unless the sender’s identity has been independently verified.
- Log out of inactive WhatsApp Web sessions to reduce the risk of account hijacking.
- Report suspected cyber fraud immediately by calling 1930 or through the National Cyber Crime Reporting Portal.
The future of wealth management is being shaped by alternative investments.
At CafeAlt Conference 2026, hear from leading industry experts, discover new business opportunities, learn how to position alternative products in client conversations, and network with wealth managers, distributors, private bankers and family offices.
Join us on Friday, August 21, 2026, at Taj Lands End, Mumbai.
Register now: www.cafemutualevents.com
Like what you are reading?
development, success stories and industry updates.
Don’t worry … it’s FREE!
Click Here For The Original Source.
