Boss scams use fake messages from CEOs and senior managers to trick employees into urgent money transfers. Learn how the scam works and how to stay safe.
One fine day you get a WhatsApp message from your boss.
“Urgently need Rs. 10,000. Please send it to this account. I’m in a meeting, so don’t call.”
You know the number. The profile photo looks right. The message sounds like something your boss could actually send. So you make the payment.
Only later do you find out that your boss never sent the message.
This is the Boss Scam, a type of impersonation scam in which criminals pretend to be a CEO, company owner or senior manager to convince an employee to transfer money. The scam can be as simple as creating a fake WhatsApp account. In some cases, criminals first gain access to the real account of a senior executive and then use it to approach employees.
That second situation makes the scam particularly difficult to spot. You may actually be receiving a message from your boss’s real WhatsApp account.
Indian authorities have warned about this form of fraud. The Indian Cyber Crime Coordination Centre (I4C) has identified the Boss Scam as an emerging cybercrime trend.
How does a Boss Scam happen?
The scam often starts with the person being impersonated.
According to I4C, criminals have been sending emails or WhatsApp messages to senior executives while pretending to be government authorities or regulators. The message may talk about an urgent compliance matter and ask the executive to open a document.
The document may look like an official notice or financial statement. But opening it can give criminals a way into the executive’s computer or WhatsApp Web session. Once they get access, they can use the account to contact other people in the organisation.
The criminal then looks for someone who can make a payment.
The request is usually made to sound routine. There may be a supplier who needs to be paid, an urgent business expense or some other reason why the money needs to move quickly.
The employee is given little time to think about it.
Moneycontrol reported that these scams can spread through WhatsApp, email, Microsoft Teams and SMS. The common thread is the pressure to act quickly, before the recipient gets a chance to check whether the request is genuine.
Why does a message from your boss feel so convincing?
Because there may be nothing obviously strange about it.
Your boss may already use WhatsApp to communicate with you. You may regularly receive instructions from them. An urgent request may not seem unusual, especially during a busy workday.
Then there is the pressure that comes with dealing with someone senior.
If the message says the payment has to be made immediately, you may worry that questioning it will delay important work. If it says the matter is confidential, you may hesitate to ask a colleague about it.
This is where the scam gets its advantage.
The criminal does not have to convince you that they are your friend. They only need to make the request look like a normal work instruction.
A familiar name and profile picture can add to that impression. So can a company logo, a copied email signature or an email address that looks almost identical to the real one.
An urgent payment should make you pause
The fact that your boss is asking you to do something urgently does not automatically mean it is a scam.
But if the request involves transferring money, you should not rely on the message alone.
Pay particular attention when the request involves a new bank account, a change in beneficiary details or a payment outside the normal company process.
SEBI has warned listed companies and regulated entities about Boss Scams and advised them not to carry out financial transactions solely on instructions received through messaging or social media platforms. It recommends independently checking payment requests, especially when bank account or beneficiary details have changed.
What should you do when your boss asks for money?
Stop before you pay. Call your boss using the phone number you already have. If you are in the same office, walk over and ask.
If they are unavailable, check with another person who normally handles or approves such payments.
The important thing is to verify the request outside the conversation where you received it.
For example, if the request comes through WhatsApp, don’t confirm it by replying to the same WhatsApp chat. If the WhatsApp account has been compromised, the person replying to you could still be the scammer.
The same applies to email. If you receive an email asking you to change a bank account or make an unusual payment, confirm it through a known phone number or your company’s normal payment process.
And don’t let the words “urgent” or “confidential” push you into skipping those checks.
What if the message really came from your boss’s account?
You should still check.
This is one of the most important things to understand about the Boss Scam.
A message coming from the genuine WhatsApp account does not necessarily mean your boss is the person sending it. I4C has warned about criminals gaining access to senior executives’ WhatsApp accounts and using them to contact employees.
So don’t treat the profile picture, saved contact name or even the familiar WhatsApp number as proof that a payment request is genuine.
Verify the person, not just the account.
What if you have already sent the money?
Don’t wait to see what happens.
Contact your bank immediately and tell them that the transaction was fraudulent. In India, you can report financial cyber fraud by calling 1930 or through the National Cyber Crime Reporting Portal.
The faster you report a fraudulent transfer, the better the chance of taking action before the money moves further.
Keep the WhatsApp messages, emails, account details, transaction records and any other information related to the incident. They may be useful when you report the fraud.
You don’t need to become an expert in cyber security to spot a Boss Scam.
Just remember this: If someone claiming to be your boss asks you to move money, verify the request before you act.
It doesn’t matter whether the message comes from WhatsApp, email or another work communication platform. It doesn’t matter whether the profile picture is correct.
Take a minute. Call the person directly.
That small pause can stop a payment that may be impossible to recover later.