HDFC Bank has issued a comprehensive advisory warning customers about the Boss Scam, a sophisticated fraud scheme targeting employees through impersonation of senior executives. According to the bank's advisory, fraudsters are increasingly combining impersonation, malware, and social engineering to make fake payment instructions appear as if they are coming directly from senior company executives. The warning specifically targets employees handling company payments, emphasizing that never assuming a payment request is genuine simply because it appears to come from your boss is crucial for protection. The bank issued this warning on August 12, 2026, as part of an awareness campaign to help customers stay safe from such frauds.
The fraud begins with relatively harmless-looking messages claiming the company has violated regulations or needs urgent compliance attention. As reported by HDFC Bank, victims may receive ZIP files supposedly containing compliance documents or security information, which can silently install malware on executive devices. Once the device is compromised, fraudsters gain access to genuine messaging accounts, allowing them to send fake messages from the CEO's actual account. In some cases, fraudsters save their own phone numbers under the CEO's name on compromised devices, making it appear as if the CEO is directly contacting employees. Using the hijacked account, fraudsters send messages to finance or accounts personnel, directing them to make urgent high-value transfers. The messages typically create a sense of urgency, with fraudsters falsely claiming that the organisation has violated regulations and pressuring recipients to act quickly.
HDFC Bank recommends verifying all urgent payment instructions through independent channels before processing transfers. For example, if a CEO sends a WhatsApp message requesting a ₹50 lakh transfer, employees should call the executive directly on a known phone number, speak face-to-face if possible, and follow existing payment-authorisation processes. The bank specifically advises never opening unexpected ZIP files and notes that regulators do not send attachments through social media applications. Companies should also restrict unauthorised software installation and keep operating systems updated. Authorised signatories must be advised against making any payments merely based on text/email without ensuring authenticity of such messages. Manish Agrawal, Senior Executive Vice President – Credit Intelligence and Control at HDFC Bank, emphasized that awareness is the strongest defence against such frauds, urging organizations to maintain strict controls around software installation and conduct regular employee awareness programs.
If employees realize they have fallen victim to the scam and unauthorized transactions have occurred, HDFC Bank advises immediate reporting to the bank to block relevant payment channels. Victims should also report incidents through the National Cyber Crime Reporting Portal and call 1930 for assistance. According to Manish Agrawal, fraudsters are using Boss Scam incidents to defraud organizations by inducing employees in accounts departments, including authorised signatories, to make payments based on fake instructions from senior executives. The bank also recommends reporting fraudulent/suspicious calls, messages on the Chakshu portal at https://sancharsaathi.gov.in/ or via the Sanchar Saathi mobile app. If you fall victim to the fraud, HDFC Bank advises you to immediately report any unauthorized transaction to your bank so that the relevant payment channels, including cards, UPI and net banking, can be blocked to prevent further losses.
