Boss Scam Warning: How CEO Impersonation Fraud Works & How to Report It in India (2026 Guide)

1. Featured Snippet: Immediate Action Plan If Targeted by the Boss Scam

If you receive an unexpected message from a senior executive demanding confidential payments or gift card purchases:

IMMEDIATE EMERGENCY ACTION PLAN:

DO NOT click any links, process bank transfers, or purchase vouchers. Immediately pause communication and verify the request by calling your manager or executive directly on their official internal phone number. If money was transferred, immediately call the National Cyber Crime Helpline at 1930 within the golden hour to request a bank lien/freeze, report the incident on cybercrime.gov.in, and inform your company's IT Security and Finance department.

2. What Is the Boss Scam & How Does CEO Impersonation Fraud Work?

The "Boss Scam" is a targeted social engineering cyber attack where fraudsters pose as high-ranking organizational leaders—such as CEOs, CFOs, Managing Directors, or Founders. The perpetrators research corporate hierarchies on public platforms like LinkedIn, company websites, and press releases to identify executive names, designation titles, and reporting structures.

After gathering intelligence, scammers construct believable scenarios to contact employees in finance, accounts, HR, or executive assistance roles. Common communication channels include:

• WhatsApp & Telegram Messages: Scammers create accounts using stolen executive profile photos and send messages claiming, *"I am in an urgent confidential board meeting and cannot take calls. Please process this vendor payment immediately."*
• Spoofed Corporate Emails: Attackers send emails from display names matching the CEO but originating from lookalike domains (e.g., ceo@cornpany.com instead of ceo@company.com).
• Microsoft Teams or Communication Tools: In compromised corporate environments, unauthorized accounts or compromised credentials are used to message employees internally.

The primary objective is to pressure the employee into bypassing normal dual-authorization payment controls, making wire transfers to fraudulent accounts, or purchasing digital gift vouchers.

3. Red Flags & Warning Signs of Executive Impersonation

Recognizing the signature patterns of the Boss Scam enables employees to spot fraud before financial loss occurs:

• Extreme Urgency & Secrecy Demands: Messages stress that the matter is *"strictly confidential"*, *"time-sensitive"*, or linked to a *"secret corporate acquisition"*, forbidding the employee from discussing the request with colleagues or managers.
• Inability to Speak on Phone: The sender claims to be in an un-disruptible meeting, flight, or international conference, refusing voice calls or video verification.
• Discrepancy in Email Address or Phone Number: The sender's name displays as your CEO, but inspecting the full email header reveals a public domain (@gmail.com, @yahoo.com) or a slightly misspelled domain name.
• Requests for Unconventional Payment Methods: Asking for emergency gift card purchases (Apple, Google Play, Amazon), cryptocurrency transfers, or direct transfers to unfamiliar third-party personal bank accounts.
• Bypassing Standard Operating Procedures (SOP): Instructions explicitly directing the employee to skip standard purchase orders, dual-signatory approvals, or finance department verification protocols.

4. Official Regulatory Advisories: SEBI & I4C Guidance

Regulators and law enforcement authorities in India have drawn attention to the sharp rise in executive impersonation scams targeting businesses and individual professionals:

• SEBI Public Advisory: The Securities and Exchange Board of India (SEBI) issued an official public warning advising market participants, listed companies, and investors about fraudulent entities and cybercriminals using executive identities and fake communication handles to solicit funds or fraudulent transactions.
• I4C Cyber Crime Intelligence: The Indian Cyber Crime Coordination Centre (I4C), operating under the Ministry of Home Affairs (MHA), tracks emerging financial cyber threats across India. I4C data indicates that Business Email Compromise and social engineering attacks targeting corporate employees have increased significantly due to public availability of organizational charts on professional networking platforms.

Both authorities emphasize that legitimate organizations and corporate executives will never demand secret fund transfers via unverified personal messaging handles or request bypassing official accounting checks.

5. Step-by-Step Guide: How to Report the Boss Scam in India

Step 1: Immediate Verification & Internal Escalation

• Stop all communication on the suspicious channel.
• Call the executive directly using their verified internal extension or official mobile number listed in your corporate directory.
• Notify your organization's Chief Information Security Officer (CISO), IT Helpdesk, and Finance Head immediately.

Step 2: Call National Cyber Crime Helpline 1930 (Golden Hour Window)

If funds have already been transferred from a personal or corporate account:

• Dial 1930 immediately to connect with the Financial Fraud Reporting System operated by state cyber police cells.
• Provide transaction details (Sender Bank Name, Account Number, UTR/Transaction Reference Number, Recipient Bank Account, Amount, and Timestamp).
• The 1930 system alerts the destination bank's nodal officer to place an immediate lien/freeze on the recipient account before the fraudster withdraws the money.

Step 3: Register Official Complaint on National Cyber Crime Portal (cybercrime.gov.in)

• Visit cybercrime.gov.in and click Report Financial Fraud.
• Log in using your mobile number and OTP.
• Enter details of the incident: platform used (WhatsApp/Email), perpetrator details (phone number/email ID), transaction slips, and screenshots of conversation threads.
• Submit the complaint to obtain a unique Cyber Crime Acknowledgement Number.

Step 4: Lodge Formal FIR at Local Police Station / Cyber Crime Cell

• Take physical printouts of email headers, chat transcripts, bank account statements, and the online cybercrime acknowledgement slip.
• Submit a written complaint to the Station House Officer (SHO) of your local Police Station or District Cyber Crime Cell requesting registration of a First Information Report (FIR).

6. Corporate Prevention Checklist for HR & Finance Teams

Organizations can implement organizational policies to neutralize CEO impersonation risks:

• Strict Dual-Authorization Controls: Mandate that all financial disbursements above defined monetary thresholds require verification by at least two independent authorized signatories through established corporate banking channels.
• Out-of-Band Verification Policy: Establish a mandatory rule that any request to change bank account details or execute urgent payments received via email/messaging MUST be verified via a direct phone call to a known number.
• Implement Email Security Protocols: Configure SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication) to block spoofed external emails pretending to originate from company domains.
• External Email Tagging: Enable automated email banners highlighting external messages (e.g., [EXTERNAL EMAIL] Proceed with caution).
• Employee Cyber Security Training: Conduct quarterly simulated phishing and BEC awareness training for accounts, finance, HR, and executive assistant staff.

7. Relevant Indian Legal Provisions

Victims and companies affected by executive impersonation fraud can pursue legal prosecution under key provisions of Indian cyber and criminal law:

• Section 66D of Information Technology Act, 2000: Punishes cheating by personation by using any communication device or computer resource with imprisonment up to 3 years and fines up to ₹1 Lakh.
• Section 66C of Information Technology Act, 2000: Prescribes punishment for identity theft, including fraudulent use of electronic signatures, passwords, or identification features of another person.
• Section 319 of Bharatiya Nyaya Sanhita (BNS), 2023: Defines Cheating by Personation (formerly IPC Section 416), carrying imprisonment up to 5 years, fine, or both.
• Section 318(4) of Bharatiya Nyaya Sanhita (BNS), 2023: Covers Cheating and dishonestly inducing delivery of property (formerly IPC Section 420), punishable with imprisonment up to 7 years and fine.

8. Related Resources & Internal Guides

For more detailed legal guides on digital fraud prevention and grievance resolution, explore our verified resources:

• Learn how to report digital threats on our comprehensive Cyber Crime Complaint Guide.
• Understand common messaging fraud tactics in our detailed WhatsApp Scam Advisory.
• Learn about high-pressure impersonation frauds in our guide on Digital Arrest Scam Redressal.
• Read our step-by-step reporting walkthrough on How to Report Cyber Crime in India.
• Learn how to initiate bank chargebacks and account freezes in our Banking Complaint Resolution Guide.