What is ‘Boss Scam’? SEBI Warns Companies Against AI-Driven Executive Impersonation Fraud

The Securities and Exchange Board of India (SEBI) has recently cautioned regulated entities and listed companies against an emerging cyber fraud known as the ‘Boss Scam’, where fraudsters impersonate Chief Executive Officers (CEOs), Managing Directors (MDs), and other senior executives to trick finance teams into transferring funds to fraudulent bank accounts.

As cybercriminals increasingly leverage artificial intelligence (AI), deepfake technology, and social engineering, Boss Scam has emerged as a significant threat to corporate financial security.

What is Boss Scam ?

Boss Scam is an advanced form of cyber fraud in which attackers impersonate senior company executives—such as CEOs, Managing Directors (MDs), or Chief Financial Officers (CFOs)—to deceive finance and accounts personnel into making unauthorized fund transfers.

The fraud relies on creating a sense of urgency and confidentiality, convincing employees that the payment is genuine and must be executed immediately.

How Does Boss Scam Work?

Cybercriminals primarily use two methods to carry out the scam.

1. AI, Deepfake and Executive Impersonation

In the first method, fraudsters exploit advanced AI-powered deepfake technology to convincingly impersonate senior executives.

They use:

• AI-generated voice cloning to mimic the CEO’s voice. 
• Deepfake video calls that appear to show the executive. 
• Fake WhatsApp groups, Microsoft Teams chats, emails, or social media accounts. 

The finance department is then instructed to transfer money to a specified bank account.

In several cases, employees are also told not to disclose the transaction, with fraudsters claiming that it concerns Unpublished Price Sensitive Information (UPSI) or another confidential corporate matter.

2. Malicious ZIP Files and WhatsApp Hijacking

The second method involves sending compressed ZIP files containing malicious executable programs.

When the recipient opens the file:

• The malware compromises the computer system. 
• It hijacks the user's active WhatsApp Web session. 
• Fraudsters gain access to the finance officer’s WhatsApp account. 
• Using the compromised account, they send payment instructions to accounts or finance staff, directing them to transfer money to fraudulent bank accounts. 

In some instances, attackers also modify contact lists by saving their own phone numbers under the names of the CEO or MD, making fraudulent messages appear authentic.

SEBI's Warning

SEBI has advised all regulated entities and listed companies to remain vigilant against Boss Scam.

According to the regulator, fraudsters are using communication platforms such as:

• Email 
• WhatsApp 
• Microsoft Teams 
• Other social media platforms 

to impersonate senior executives and instruct employees or counterparts to execute urgent financial transactions that ultimately result in funds being transferred to criminals.

How to Protect Against Boss Scam

Organizations can reduce the risk of Boss Scam by adopting the following cybersecurity measures:

• Verify all high-value payment requests through an independent communication channel. 
• Never rely solely on WhatsApp, email, or video calls for payment authorization. 
• Implement multi-factor authentication (MFA) across corporate systems. 
• Avoid opening ZIP files or attachments received from unknown or suspicious sources. 
• Regularly review active WhatsApp Web and other login sessions. 
• Train employees to identify AI-generated deepfakes and social engineering attacks. 
• Establish strict approval workflows for financial transactions. 
• Immediately report suspicious communications to the IT and cybersecurity team. 

Why is Boss Scam Significant?

• It represents a new generation of AI-enabled cyber fraud. 
• The use of deepfake technology and voice cloning makes the scam highly convincing. 
• Listed companies, banks, financial institutions, and large corporations are particularly vulnerable. 
• The scam highlights the growing need for stronger cybersecurity practices, executive verification protocols, and employee awareness programs.

Frequently Asked Questions (FAQs)