The Securities and Exchange Board of India (Sebi) issued a warning on Friday about a rising cyber fraud known as the 'Boss Scam', where fraudsters impersonate top executives to siphon off funds. According to reports from CNBC TV18 and The Hindu, the market regulator was alerted by the Indian Cyber Crime Coordination Centre (I4C) about an emerging trend involving impersonation of chief executive officers (CEOs) or managing directors (MDs) using digital communication tools. As per Sebi's statement, the advisory follows an alert from I4C which has flagged a rise in CEO/MD impersonation fraud targeting organisations through email, WhatsApp, Microsoft Teams and other social media platforms. The regulator cautioned that fraudsters are targeting CEOs or high-ranking officials via email or WhatsApp by impersonating them, directing subordinates to carry out instructions resulting in transfer of funds to fraudsters. The advisory specifically targets all regulated entities and listed companies, with The Economic Times reporting that Sebi issued the warning after I4C observed an increasing trend of cybercriminals targeting high-ranking officials and finance executives through CEO or MD impersonation schemes to fraudulently obtain fund transfers.
Sebi noted that perpetrators are increasingly deploying sophisticated techniques to impersonate company heads, with AI-powered tools now making fraud more sophisticated, faster, and accessible to a wider range of criminals. According to Sebi's statement, fraudsters are using advanced methods such as deepfake voice cloning and AI-generated video calls to deceive employees. In some instances, they create fake social media groups to lend credibility to their requests, while also sending malicious compressed files containing executable malware that can compromise systems and hijack WhatsApp Web sessions. The regulator specifically mentioned that fraudsters use artificial intelligence tools such as voice cloning and deepfake video calls to make the impersonation appear genuine. Additionally, Sebi revealed that another method involves sending a compressed ZIP file containing malicious software. Once the file is opened on a Windows device, the malware hijacks active WhatsApp Web sessions, allowing fraudsters to gain access to the victim's account and send payment instructions to finance or accounts personnel. The Hindu reports that alternatively, if the fraudster achieves complete device takeover, they secretly alter the contact list on the device, and saves the fraudster's phone number under the name of the CEO/MD and use that secondary number to instruct finance officer into transferring funds.
Sebi has advised companies to exercise caution and verify any financial instructions received through digital platforms by directly contacting the concerned official. The regulator urged firms not to act solely on messages received via social media and to avoid installing unverified files. According to Sebi's statement, the regulator advised listed companies and regulated entities to independently verify requests received through WhatsApp, email or social media by directly calling the concerned senior official. The Hindu reports that the market regulator alerted corporate professionals to "remain cautious and cross-check requests received through WhatsApp/ email/ social media platforms, by calling their seniors". Sebi also urged organisations not to transfer funds solely on the basis of instructions received through social media platforms and to avoid installing executable files without first verifying the sender's identity. The regulator further advised entities to log out of inactive WhatsApp Web sessions and immediately report cyber fraud incidents by calling the national cybercrime helpline 1930 or through the Cyber Crime portal. With AI-powered tools now making fraud more sophisticated, Sebi emphasizes that every unexpected message, every urgent ask, and every deal that looks a little too good deserves a few seconds of pause before you act, as AI can fake almost anything convincingly but cannot fake the pause that users take before responding.
In separate advisories, the National Stock Exchange (NSE) has also sounded the alarm about new-age investment frauds targeting India's financial ecosystem. As per CNBC TV18, the NSE has warned companies and investors that cyber fraudsters are increasingly using artificial intelligence, fake trading platforms and social engineering to target the country's financial ecosystem. The NSE's advisory specifically highlights the rise of fake trading apps and phishing schemes that are being used alongside the 'Boss Scam' to deceive investors and companies. The combined warnings from both market regulators underscore the growing sophistication of cyber fraud techniques and the urgent need for enhanced security measures across India's financial sector. The coordinated approach by Sebi and NSE demonstrates the seriousness with which regulators are treating these emerging threats to market integrity and investor protection.
