Sharp rise in CEO fraud: I4C warns of 'Boss Scam' hitting corporate India

For CFOs and corporate treasurers, this is a wake-up call: the weaponization of WhatsApp means a simple message from the CEO's compromised account can now pierce financial controls and authorize illicit wire transfers. With no precise loss figures yet but a clear warning from I4C, finance departments must urgently verify that their payment authorization protocols are not susceptible to such impersonation attacks on mobile platforms.

India's cybercrime watchdog has sounded an alarm over a sharp rise in 'Boss Scam' cases—a WhatsApp-based CEO impersonation fraud that is compromising executive accounts and directing finance staff to transfer funds to mule accounts. The Indian Cybercrime Coordination Centre (I4C), a wing of the Ministry of Home Affairs, observed a sudden spike in complaints on the National Cyber Crime Reporting Portal (NCRP) from Delhi, Gujarat, Maharashtra, Rajasthan and other states, prompting it to issue a public warning on 7 August 2026. The scam begins with a deceptively simple vector: a compressed .zip file with names like '0714 Statement of Account.zip', 'RBI.zip', or 'MCA.zip' sent over WhatsApp, SMS or email. When the recipient clicks on the attachment, their WhatsApp account is immediately compromised. The malware then silently forwards the same malicious file to all contacts and groups, often with a note instructing recipients to pass it on to their 'company finance manager for verification' and to open it on a desktop—thus chaining the infection deeper into corporate networks.

“

India's cybercrime watchdog has sounded an alarm over a sharp rise in 'Boss Scam' cases—a WhatsApp-based CEO impersonation fraud that is compromising executive accounts and directing finance staff to transfer funds to mule accounts.

The advanced stage of the fraud exploits the hijacked account's authenticity. Fraudsters either use the compromised WhatsApp of a senior executive directly or covertly save an alternate number in victims' contacts under the executive's name, then issue urgent payment instructions to finance teams. Because the messages come from a trusted contact, or appear to, they bypass normal skepticism. The I4C noted that this modus operandi has been widely reported across India's industrial and commercial hubs, indicating a coordinated campaign targeting professionals and business owners. The use of account statements, RBI (Reserve Bank of India) branding, and MCA (Ministry of Corporate Affairs) filenames adds a layer of social engineering that exploits anxiety about regulatory compliance and financial audits.

This fraud pattern mirrors global Business Email Compromise (BEC) and CEO fraud trends but is specifically weaponized for WhatsApp, which dominates business communication in India. The platform's end-to-end encryption and personal nature make it an ideal channel for deception, as employees often treat WhatsApp messages from a boss as inherently trustworthy. The I4C's warning underscores a broader vulnerability: as organizations increasingly rely on instant messaging for financial approvals, the attack surface expands. No technical sophistication in malware is required—just the ability to craft plausible filenames and exploit human psychology. However, the auto-forwarding capability suggests the file may contain a script or malware that accesses WhatsApp Web or the mobile app's permissions, though the source does not detail the technical exploit.