A Hyderabad company’s accountant transferred ₹1.2 crore in March 2026 to a WhatsApp number that looked like the company’s owner. The display photo matched. The name matched. The instructions sounded urgent and reasonable. The fraud surfaced 4 days later, and the bank account on the receiving side was already tied to at least four other cybercrime cases. If you work in finance, accounts, or operations at any Indian company, this is the scam most likely to hit you next.
Key findings
- WhatsApp boss impersonation is a no-hacking scam: scammer creates a new WhatsApp account using the director’s name and stolen LinkedIn photo, messages the finance team from an unknown number, asks for an urgent transfer to a vendor or routing account. Nothing technical breaks; everything depends on three easy-to-find facts (director photo + name + finance staff names) and one easy-to-assume belief (a message with the boss photo is from the boss).
- The 5-step script repeats across cases: friendly opener (sender claims to be the director with a new number), pretext (in a meeting / on a flight / unreachable), instruction (urgent vendor payment), urgency (must happen this hour), redirect (third-party account, not the real vendor). Recognising the script in the first message stops the loss.
- Hyderabad case: INR 1.2 crore lost, transferred 13 March 2026 and discovered on 17 March. Reported by Telangana Today (18 March 2026) and NewsMeter (1 April 2026), which covered the arrest. Variants of the same script have been reported from other Indian cities, with losses running into crores per incident.
- Three changes harden any finance team this week, no tool purchase needed: verbal verification mandate above an INR 50,000 threshold, internal directory of known director numbers updated quarterly, monthly 20-minute case-based awareness session.
- If money already moved, speed of reporting is the single largest recovery factor. Call 1930, file at cybercrime.gov.in within 24 hours, notify bank fraud team in parallel, file FIR with local cyber cell. Banks can sometimes freeze the recipient mule account within hours, but only if you report fast.
- Sanchar Saathi (sancharsaathi.gov.in) and Chakshu (sancharsaathi.gov.in/sfc) are the takedown channels for reporting the offending number, separate from the money-recovery route through 1930 and your bank.
Cybersecify is a Bengaluru-based cybersecurity firm. We run free verification on suspicious WhatsApp messages claiming to be from a director or senior executive: send a screenshot to +91 99644 43350 and we tell you whether it matches a known impersonation pattern. For SaaS startups and SMEs with material vendor cash flow, we run paid finance-team awareness sessions covering dual-channel approval, deepfake CFO scenarios, and incident response playbooks, plus a redacted sample pentest report showing the evidence format we use when scoping account-takeover exposure on production SaaS, including the WhatsApp and voice-channel risk surface for finance and ops teams.
Who this is for
Finance staff, accountants, executive assistants, junior managers, HR teams, and anyone authorised to move company money or send sensitive information. Founders and directors should also read this and forward it to their teams. The scam works on careful, experienced people. It is engineered to bypass professional skepticism, not technical skill.
What happened in Hyderabad
On 13 March 2026, an accountant at a Hyderabad firm received a WhatsApp message from an unknown Indian mobile number. The profile photo was the company’s owner. The display name was her full name. The first message was casual, then quickly turned into a business instruction: an urgent payment had to go out, and the staff member should process the transfer right away. The owner travelled abroad regularly and had entrusted financial responsibilities to staff, which is the gap the fraudsters worked.
Over a sequence of messages, the accountant transferred ₹1.2 crore to bank accounts the scammer provided. He did what most loyal employees do when the boss asks for something urgent. He acted.
The fraud surfaced four days later, on 17 March, when a second similar instruction arrived and the accountant finally checked with the business owner directly. Telangana Today reported on 18 March 2026 that the message used the entrepreneur’s name and display picture, and that the transfer went out without cross-verification.
On 1 April 2026, Hyderabad Cyber Crime police arrested a Kozhikode resident in the case; two associates were still absconding. NewsMeter reported, citing DCP (Cyber Crime) V Aravind Babu, that the bank account used to receive the money was already tied to at least four other cybercrime cases across Kerala, Karnataka and Rajasthan, and had processed over ₹1.67 crore in fraudulent funds. The account holder was paid a ₹10 lakh commission for supplying it. The pattern was industrial, not opportunistic.
How the scam actually works
There is no hacking involved. Nothing technical broke. The scam works because three things are easy to find and one thing is easy to assume.
Three easy-to-find things:
- The director’s photo, usually from LinkedIn, the company About Us page, news mentions, or speaker pages.
- The director’s full name and exact title.
- The names and rough roles of finance or operations staff, again from LinkedIn or the company website.
One easy-to-assume thing:
That a WhatsApp message bearing the boss’s photo and name is from the boss.
The scammer combines these. They buy or rent an Indian SIM card, create a new WhatsApp account, set the display name as the director’s full name, upload the director’s LinkedIn photo, and message the target staff member. The phone number is new and unknown, but the profile feels familiar. That is the entire trick.
The 5-step script
The pattern repeats across cases reported through 2024, 2025, and 2026.
- The opener. A polite first message from an unknown number. “Hi, this is [Director Name]. I changed my number. Please save this.” Sometimes a casual question first: “Are you in office?” or “Free for a quick task?”
- The pretext. The director is in a meeting, on a flight, with an investor, in a hospital, or otherwise unable to take calls. This is the reason given for using WhatsApp instead of calling.
- The instruction. A vendor payment, a client refund, a statutory deposit, a personal urgent transfer that the director will reimburse later. Amounts vary from ₹50,000 in tests to over ₹1 crore in mature attacks.
- The urgency. The transfer must happen within the hour, before market close, before the office closes, before an investor meeting. Speed is the lever.
- The redirect. The bank account provided is in a third party’s name with an explanation: “vendor account is closed, use this routing account” or “personal account of our CA, please transfer there.” The receiving account is always a mule account, never a real vendor.
If you have received messages that look like this, you have already seen the scam. The defence is what you do next.
Why corporates are the target
Three reasons.
Volume of money flowing. Even small companies move lakhs in routine vendor payments every month. A single fraudulent transfer of ₹5 to 50 lakh fits inside normal operating cash flow and does not trigger immediate alerts.
Distributed authority. In most Indian SMEs and startups, finance staff are trusted to act on director instructions without a formal four-eyes approval flow. A WhatsApp message from the boss is treated as a valid instruction.
Public director identity. Funded startups and growing SMEs publicise their founders and leadership. LinkedIn profiles, podcast appearances, speaker bios, and press coverage make a director’s name and photo trivial to harvest.
The I4C portal at cybercrime.gov.in, run by the Indian Cyber Crime Coordination Centre under the Ministry of Home Affairs, is where a complaint in this category is filed, and the 1930 helpline is operated by the same body.
6 red flags any finance team can apply
Any one of these on its own is enough to pause and verify before acting. Do not wait for the second flag.
1. The message comes from a new or unknown WhatsApp number
The most basic tell. The director has an existing WhatsApp number that your team already uses. A message from any other number, no matter how convincing the photo, should be verified through a known channel before acting.
2. The director claims to have changed their number
Real number changes happen, but the standard response is the same. Call the old number. Email. Walk to the cabin if you are in office. Confirm on a second channel before treating the new number as authentic.
3. The instruction comes only on WhatsApp
Real finance instructions in a healthy company go through email, an internal ticketing system, or in-person approval. A founder who only ever talks on WhatsApp for urgent payments is unusual, and a founder who suddenly does that for the first time should trigger immediate verification.
4. The transfer is urgent and time-bound
Urgency is the universal scam ingredient. Real business payments almost never lose anything from waiting 15 to 30 minutes for verification. Any message that says it must happen before a meeting ends, before bank cutoff, or before an investor sees a statement is engineering pressure.
5. The account is in a third party’s name
Vendor payments go to vendor accounts. Statutory deposits go to government accounts. Any explanation that says use this personal account instead, or this routing account, is the most common single feature of the scam.
6. The director is conveniently uncontactable
In a meeting, on a flight, at a hospital, in court. Always a reason that prevents you from calling. If you cannot reach the director on the known number, that is itself the verification result. Escalate to a co-founder, the CFO, or a senior colleague.
What to do if you got the message
- Do not transfer. Pause. The scam survives on speed.
- Verify on a known channel. Call the director on the existing office or mobile number that your team already uses. Speak to them in person if you can. Email the official work address.
- Escalate if the director is unreachable. Go to a co-founder, the CFO, the CEO, or a senior colleague. No real transfer instruction loses anything from a 15-minute delay.
- Save evidence. Screenshots of the WhatsApp chat, the sender number, the profile photo, the account details provided, any audio messages. Do not delete the chat.
- Tell your IT or security team. This is a corporate incident, not a personal one. They need to know so they can warn other staff.
What to do if money already moved
Speed of reporting is the single biggest factor in fund recovery. Act in this order:
- Call 1930. This is the national cybercrime helpline operated 24/7 by I4C under MHA. They will guide you on next steps and initiate the bank-side hold process. (I4C FAQ)
- File a formal complaint at cybercrime.gov.in within 24 hours. This is required for any recovery action and creates the formal record.
- Notify your bank’s fraud team in parallel. Banks have fast-track escalation channels for ongoing cybercrime. The earlier they know, the better the chance of freezing the recipient account before the money is layered out.
- File an FIR with the local police cyber cell. This is needed for insurance claims, internal HR processes, and any subsequent legal action.
- Preserve all evidence. Chat exports, transaction screenshots, bank statements, any device logs. Do not delete or modify anything.
The Hyderabad ₹1.2 crore case surfaced 4 days after the transfers. Recovery would have been higher if the discrepancy had been caught within hours.
How to harden your finance process this week
Three changes, none of them require a tool purchase.
Mandate verbal verification for any transfer above a threshold. Pick a number that fits your business. For most Indian SMEs, ₹50,000 is reasonable. Any WhatsApp or email instruction for a transfer above that threshold must be verbally confirmed with the requestor on a known phone number before processing.
Maintain an internal directory of known director numbers. A simple list, updated quarterly, sent to all finance and operations staff. Any new number claiming to be a director is treated as unverified by default until cross-checked against this list.
Run an internal awareness session. Forward this article. Walk through the Hyderabad case in a 20-minute Friday meeting. Make it normal to pause and verify. The cultural permission to slow down is the strongest defence.
Sent or received a suspicious message? We verify free
If a WhatsApp message claiming to be your boss or anyone in authority feels off and you want a sanity check before doing anything, send it to us privately.
WhatsApp / Call: +91 99644 43350
Send a screenshot, the sender number, the profile photo, or whatever details you have. We tell you whether it is real or a scam, in plain language, with no charge.
What we do:
- Cross-check the sender number against known scam patterns
- Look for the boss impersonation script tells (new number, urgency, third-party account, only-WhatsApp insistence)
- Tell you what verification step to take next
What we do not do:
- Charge for the verification
- Ask for your bank details, OTPs, UPI PIN, or company financial data
- Pretend to be law enforcement or a banking authority
Verification is free. You can also email help@cybersecify.com with the same details.
How this differs from WhatsApp Ghost Pairing
We get this question often, so worth clarifying. The WhatsApp Ghost Pairing scam tricks you into linking your real WhatsApp account to a scammer’s device through a fake pairing code, after which they read your messages and impersonate you to your contacts. That attack compromises your actual account.
Boss impersonation does not touch your WhatsApp account at all. The scammer just creates a brand new WhatsApp profile using your boss’s photo and name, then messages your finance team from an unknown number. Two different attacks, two different defences. Worth understanding both.
For broader public awareness, also see our guides on digital arrest scams, fake DPDP notices, and the Karnataka citizen safety guide.
Save this number now
If anyone on your team receives a WhatsApp message claiming to be the boss or director with an urgent transfer instruction, the right move is to verify before acting. Save +91 99644 43350 in your phone now. During an active scam attempt, you will not have time to search.