₹1.5 Crore Stolen in WhatsApp ‘Boss Scam’: How Cybercriminals Target Companies

Ahmedabad Cybercrime Police Uncover Organised Network Using Fake SIM Cards and Malware

A company owner’s identity was allegedly used by cybercriminals to trick an employee into transferring ₹1.5 crore from the company’s bank account. The incident has brought attention to a growing form of cyber fraud known as the “Boss Scam,” in which criminals impersonate senior company executives and issue fake payment instructions through WhatsApp.

How the Fraud Took Place

According to the case investigated by Ahmedabad Cybercrime Police, the company owner received a WhatsApp message on June 23, 2026, from an unknown number. The sender claimed to be associated with the Reserve Bank of India’s risk-control department and warned that unusual transactions had been detected in the company’s bank account.

The message also contained a ZIP file. The company accountant was asked to open the file and collect additional information.

After the file was downloaded on the accountant’s computer, the attackers allegedly gained access to the owner’s WhatsApp contacts and messages. The next morning, while the owner was attending a wedding in Udaipur, the cybercriminals reportedly sent a WhatsApp message to the accountant using the owner’s name and instructed him to transfer ₹1.5 crore through RTGS to a company in Kolkata.

The fraud was discovered soon after, and a complaint was filed with the cybercrime police. Authorities said they managed to recover ₹1.135 crore, while approximately ₹25 lakh had already been transferred abroad. Two people from West Bengal were arrested in connection with the case.

How the ‘Boss Scam’ Works

In this type of fraud, scammers first attempt to gain access to a company`s digital communications. According to investigators, they may pose as officials from the RBI or another government agency and send a malicious ZIP file containing malware such as .exe or .dll files.

Opening such a file on a computer connected to WhatsApp Web can allow attackers to take control of the account. They can then use the name and profile picture of a company director or CEO to make their messages appear genuine.

The attackers subsequently contact accountants or finance employees and demand an immediate money transfer. Fake SIM cards and OTPs can also be used to activate and control WhatsApp accounts.

Investigation Reveals Wider Cybercrime Network

The Ahmedabad investigation reportedly uncovered a broader network in which different individuals handled different parts of the operation, including SIM cards, OTPs, WhatsApp accounts and communication with victims.

Police examined information connected to around 4,500 SIM cards and investigated 251 complaints from 26 states. These included 194 online financial fraud cases, three Boss Scam cases and 29 online or social-media-related offences.

More than n 10,000 devices containing malware were also identified during the investigation, according to the police.

The investigation is continuing, with police examining WhatsApp chats, groups, phone numbers and other digital evidence to identify additional suspects and alleged key members of the network.

How Businesses Can Avoid Such Scams

Cybercrime officials have advised companies and employees to take several precautions:

- Do not open unknown ZIP, .exe, .dll or .apk files received through WhatsApp or email.

- Verify urgent payment requests directly with the CEO, director or concerned executive using an official phone number or another trusted method.

- Regularly check WhatsApp`s Linked Devices and immediately remove any unfamiliar device.

- Enable two-step verification on WhatsApp.

- Keep operating systems, antivirus software and endpoint-security tools updated.

- Companies should consider software controls that block unknown executable files.

Act Quickly If Money Is Lost

Authorities have stressed that speed is critical in cyber-fraud cases. Anyone who becomes a victim of financial fraud should immediately contact the cybercrime helpline at 1930 or file a complaint through the national cybercrime reporting website.

In this case, the early complaint helped investigators take swift action and recover a substantial portion of the stolen money.

The biggest warning for businesses is clear: never act on an urgent payment request received through WhatsApp without independently verifying it—even when the message appears to come from the company`s owner or senior management.