Imagine receiving a WhatsApp message from your CEO asking you to transfer ₹50 lakh to a new bank account — and the message is coming from the CEO’s actual account. You may think you are safe because you recognise the name, the profile picture and even the messaging account. But that is precisely how the latest “Boss Scam” works.
Fraudsters are increasingly combining impersonation, malware and social engineering to make fake payment instructions look like they are coming directly from a senior executive, according to an advisory issued by HDFC Bank.
For employees handling company payments, the warning is particularly important: never assume a payment request is genuine simply because it appears to come from your boss.
In the Boss Scam, fraudsters impersonate senior leaders and trusted colleagues on social messaging apps to trick employees into making payments or sharing sensitive information.
How the scam starts
The fraud can begin with something that looks relatively harmless.
A fraudster may send an email or message pretending to be a senior company executive or even a regulator. The message may claim that the company has violated a regulation or needs to urgently address a compliance or security issue.
The objective is to create panic.
The victim may then receive a ZIP file supposedly containing compliance documents or security information.
Opening the file can silently install malware on the executive's laptop or phone.
Once the device is compromised, the fraudster may gain access to the executive's genuine messaging or social-media account.
And that's when the scam becomes much harder to spot.
The fake message may come from the real account
Instead of creating a fake WhatsApp or messaging profile with the CEO's photograph, criminals can use the compromised account itself.
They can then message employees in the finance or accounts department and issue an apparently legitimate instruction to make an urgent, high-value payment.
In some cases, according to HDFC Bank, fraudsters may even save their own phone numbers under the CEO's name on the compromised device.
So the employee checking the contact may see the CEO's name and assume the request is authentic.
The biggest lesson: a genuine-looking account does not automatically mean a genuine payment instruction.
Why the scam can work so easily
The fraud exploits something businesses rely on every day: trust and hierarchy.
An accounts employee receiving a message saying, “Please make this payment immediately” from the CEO may hesitate to question it — particularly if the message says the matter is confidential or time-sensitive.
Fraudsters deliberately create that sense of urgency.
The less time an employee has to think, verify the request or speak to the executive directly, the greater the chances of the payment going through.
That is why the simplest defence can also be the most effective: stop and verify.
What should you do if your boss asks for an urgent transfer?
Don't respond to the message by asking, “Is this really you?”
If the executive's account has been compromised, the fraudster can simply reply: “Yes, do it immediately.”
Instead, verify the request through an independent channel.
For example, if the CEO sends a WhatsApp message asking for a ₹50 lakh transfer:
- Call the CEO directly on a known phone number.
- Speak to them face-to-face if possible.
- Follow the company's existing payment-authorisation process.
- Independently verify any change in the beneficiary's bank account.
- Do not rely solely on the messaging account from which the request originated.
HDFC Bank specifically advises independently cross-checking urgent payment instructions and requests to change beneficiary accounts.
Never open an unexpected ZIP file
Another major red flag is an unexpected attachment.
A message claiming to be from a regulator, senior executive or colleague may ask you to open a ZIP or executable file containing “compliance documents”.
Don't.
HDFC Bank advises users not to download or install unknown ZIP or executable files received from unknown sources.
The bank also notes that regulators do not send such attachments through social-media or messaging applications.
Companies should also restrict the installation of unauthorised software and keep operating systems and malware-detection tools updated.
What if you have already made the payment?
Speed matters.
If you realise that you have fallen for a scam and an unauthorised transaction has taken place, HDFC Bank advises victims to immediately inform their bank.
The objective is to get the relevant payment channels blocked and prevent further unauthorised transactions.
Victims should also report the incident by calling 1930 and file a complaint through the National Cyber Crime Reporting Portal.
Suspicious calls or messages can also be reported through the government's Chakshu facility on Sanchar Saathi.
Don't let urgency override your company's controls
Manish Agrawal, Senior Executive Vice President – Credit Intelligence and Control at HDFC Bank, said fraudsters are targeting authorised signatories and accounts employees by making fake instructions appear to come from senior executives.
“Awareness is the strongest defence against such frauds,” Agrawal said.
He urged organisations to have strict controls around software installation, conduct employee awareness programmes and require payment requests to be verified before they are processed.
For employees authorised to make payments, his message is particularly relevant: don't approve a transfer merely because the instruction arrives by text or email.
"In the event of falling prey to such fraud the victim should immediately report the unauthorised transactions to the bank to get the payment channel blocked, i.e., cards/UPI/net banking to safeguard against future losses. Customers should also file a complaint by calling 1930, a helpline number started by the Ministry of Home Affairs (MHA) as well as submit a complaint on the National Cyber Crime Reporting Portal https://www.cybercrime.gov.in," said Agrawal.
 "Boss Scam: That urgent payment request from your CEO could be a trap")
