A WhatsApp message from your CEO, Rs 1.5 crore gone. How the 'Boss scam' is tricking ...

New Delhi: An urgent regulatory notice, a malware-laden ZIP file and a WhatsApp message bearing the CEO’s profile picture are the latest tools in a sophisticated cyber fraud that has already siphoned off crores from companies and individuals. Dubbed the “boss scam”, the fraud has prompted the Indian Cybercrime Coordination Centre (I4C) to issue an advisory as investigators trace syndicates operating through mule bank accounts.

One of the victims of the fraud was Ahmedabad real estate businessman Pravin. On 23 June, around 11 am, he received a WhatsApp message from an unknown number.

“This is a notification from the Reserve Bank of India (RBI),” it stated. “The bank has issued a notice regarding risk control related actions and unusual financial transactions related to your company’s bank account. In view of this, action may be taken to restrict or suspend your account. Therefore, your finance department is requested to immediately review the relevant details and provide necessary cooperation.”

“Please provide the requested information within three working days. Otherwise, the use of your account may be adversely affected. Thank you for your cooperation,” added the message, that had a 3.3 MB ZIP file attached.

Pravin, who narrated the sequence of events to ThePrint over phone Monday, forwarded the message to his accountant, Pritish.

“Pritish saw the message on WhatsApp Web on his desktop where the ZIP file was downloaded. Within minutes, he received a WhatsApp message from an account that had my profile picture, asking him to transfer Rs 1.5 crore to a Kolkata-based company’s account and not to call back. He transferred the sum, assuming I had texted him,” Pravin said.

This CEO impersonation fraud, in which cybercriminals target high-ranking officials and executives by delivering malicious archives via email or WhatsApp and request urgent regulatory compliance, is what the I4C has warned in an advisory issued on 22 June.

“Once executed, the malware compromises the executive’s Windows device and active Web WhatsApp sessions, enabling the fraudsters to message subordinate employees and orchestrate fraudulent financial transfers,” warns the I4C.

“If the attacker achieves complete device takeover, they covertly modify the device’s list, saving a fraudulent, attacker-controlled phone number under the name of the ‘CEO’, and use that secondary number to instruct employees into transferring funds,” it adds.

Pravin said the fraudsters gained access to his accountant’s computer through WhatsApp Web after the malware was downloaded.

“The fraudster managed to read all the messages between me and my accountant, and that is when he texted Pritish, assuming my identity. The fraudster instructed Pritish to not make any phone calls. He sent him details of an IndusInd Bank account and the money was subsequently transferred. When I received a text the money being debited, I immediately called Pritish. Then he narrated what had happened,” he told ThePrint.

A senior police officer from Ahmedabad Crime Branch said a case has been registered under Bharatiya Nyaya Sanhita Sections 318(4) (cheating), 319(2) (cheating by personation) and under the IT Act and investigation initiated.

“In this case, Pritish’s WhatsApp was hacked. Earlier, APK files were being shared, now it is a ZIP file,” the officer told ThePrint.

Police in other states have also issued advisories warning against the “boss scam”.

Also Read: Mass weddings are booming across India. So are the scams around them