Udaipur : HDFC Bank, India’s leading private sector bank, advises customersto remainvigilant againstBoss Scam (impersonation of a business leader/ senior company executive). The aim is to increase awareness about such frauds to safeguard customers.In the Boss Scam, fraudsters impersonate senior leaders and trusted colleagues on social messaging apps to trick employees into making payments or sharing sensitive information.
Cautioning on this fraud, Mr. Manish Agrawal, Senior Executive Vice President – Credit Intelligence and Control – HDFC Bank, said, “The fraudsters are using Boss Scam incidents to defraud organisations where the employees from the accounts department (authorised signatories) are induced to make payment on pretext of fake instructions received from thesenior executive of the organisation. Awareness is the strongest defence against such frauds. These scams combine social engineering, malware and impersonation techniques to trick employees into making unauthorised fund transfers. Organisations should ensure strict controls around software installation, employee awareness programmes, and verification of payment requests before processing transactions. Authorised signatories must be advised against making any payments merely based on text / email without ensuring authenticity of such messages.”
How does this scam work:
Fraudsters send emails or messages on social media and messaging platforms, impersonating regulators or senior company executives such as CEOs and CXOs. The message typically claims that the organisation has violated some regulations, creating an urgency and pressuring the recipient to act quickly. The fraudsters share a ZIP file, supposedly containing compliance or security documents. When opened, it silently installs malware. The malware compromises the executive’s device (laptop / mobile), giving fraudsters access to their real social media messaging app account. Using the hijacked account, fraudsters send messages to the finance or accounts personnel, directing them to make urgent high-value transfers. In some cases, criminals save their own numbers under the CEO’s name on the compromised device, making fraudulent instructions appear completely legitimate.
Tips to protect yourself from BossScam
- Always verify financial requests independently: Cross-check any urgent payment instruction or beneficiary account change request through a direct phone call or face to face confirmation.
- Never install unknown files: Do not download or install ZIP/executable files received from unknown sources—regulators never send attachmentsvia social media apps.
- Enforce software restriction policies on company systems. Keep device’s operating system malwaredetection tools updated.
- Report fraudulent/suspiciouscalls, messages on the Chakshu portal at https://sancharsaathi.gov.in/or via the Sanchar Saathi mobile app.
In the event of falling prey to such fraud the victim should immediately report the unauthorised transactions to the bank to get the payment channel blocked, i.e., cards/UPI/net banking to safeguard against future losses. Customers should also file a complaint by calling 1930, ahelpline number started by the Ministry of Home Affairs (MHA) as well as submit a complaint on the National Cyber Crime Reporting Portal https://www.cybercrime.gov.in
