A Hyderabad accountant transferred ₹1.2 crore in 2026 to a WhatsApp number that looked like her director. The display photo matched. The name matched. The instructions sounded urgent and reasonable. The fraud surfaced 4 days later, and by then the bank account on the receiving side had already been used for 4 other scams. If you work in finance, accounts, or operations at any Indian company, this is the scam most likely to hit you next.
Key findings
- WhatsApp boss impersonation is a no-hacking scam: scammer creates a new WhatsApp account using the director’s name and stolen LinkedIn photo, messages the finance team from an unknown number, asks for an urgent transfer to a vendor or routing account. Nothing technical breaks; everything depends on three easy-to-find facts (director photo + name + finance staff names) and one easy-to-assume belief (a message with the boss photo is from the boss).
- The 5-step script repeats across cases: friendly opener (sender claims to be the director with a new number), pretext (in a meeting / on a flight / unreachable), instruction (urgent vendor payment), urgency (must happen this hour), redirect (third-party account, not the real vendor). Recognising the script in the first message stops the loss.
- Hyderabad case: INR 1.2 crore lost. Reported by Telangana Today and Newsmeter through 2026. Variants have hit companies in Bengaluru, Mumbai, Chennai, Pune, and Delhi NCR through 2024 and 2025, with losses from INR 40,000 to multiple crores per incident.
- Three changes harden any finance team this week, no tool purchase needed: verbal verification mandate above an INR 50,000 threshold, internal directory of known director numbers updated quarterly, monthly 20-minute case-based awareness session.
- If money already moved, speed of reporting is the single largest recovery factor. Call 1930, file at cybercrime.gov.in within 24 hours, notify bank fraud team in parallel, file FIR with local cyber cell. Banks can sometimes freeze the recipient mule account within hours, but only if you report fast.
- Sanchar Saathi (sancharsaathi.gov.in) and Chakshu (sancharsaathi.gov.in/sfc) are the takedown channels. As of February 2026, Sanchar Saathi has terminated over 3 crore fraud connections and disabled 16.97 lakh WhatsApp accounts in coordination with the platform.
Cybersecify is a Bengaluru-based cybersecurity firm. We run free verification on suspicious WhatsApp messages claiming to be from a director or senior executive: send a screenshot to +91 99644 43350 and we tell you whether it matches a known impersonation pattern. For SaaS startups and SMEs with material vendor cash flow, we run paid finance-team awareness sessions covering dual-channel approval, deepfake CFO scenarios, and incident response playbooks, plus a redacted sample pentest report showing the evidence format we use when scoping account-takeover exposure on production SaaS, including the WhatsApp and voice-channel risk surface for finance and ops teams.
Who this is for
Finance staff, accountants, executive assistants, junior managers, HR teams, and anyone authorised to move company money or send sensitive information. Founders and directors should also read this and forward it to their teams. The scam works on careful, experienced people. It is engineered to bypass professional skepticism, not technical skill.
What happened in Hyderabad
In early 2026, an accountant at a Hyderabad company received a WhatsApp message from an unknown Indian mobile number. The profile photo was her company director. The display name was the director’s full name. The first message was casual, then quickly turned into a business instruction: an urgent vendor payment had to go out, the director was tied up in a meeting, and the staff member should process the transfer right away.
Over a sequence of messages, the accountant initiated transfers totalling ₹1.2 crore to bank accounts the scammer provided. She did what most loyal employees do when the boss asks for something urgent. She acted.
The fraud surfaced 4 days later when the actual director was asked about the payments. By then, the receiving bank account had been frozen by a separate complaint. Investigators learned the same mule account had been used in 4 other similar scams across different Indian cities in the weeks before. The pattern was industrial, not opportunistic.
The case was reported by Telangana Today and Newsmeter in their crime reporting through 2026. Variants of the same scam have hit companies in Bengaluru, Mumbai, Chennai, Pune, and Delhi NCR through 2024 and 2025, with losses ranging from ₹40,000 to multiple crores per incident.
How the scam actually works
There is no hacking involved. Nothing technical broke. The scam works because three things are easy to find and one thing is easy to assume.
Three easy-to-find things:
- The director’s photo, usually from LinkedIn, the company About Us page, news mentions, or speaker pages.
- The director’s full name and exact title.
- The names and rough roles of finance or operations staff, again from LinkedIn or the company website.
One easy-to-assume thing:
That a WhatsApp message bearing the boss’s photo and name is from the boss.
The scammer combines these. They buy or rent an Indian SIM card, create a new WhatsApp account, set the display name as the director’s full name, upload the director’s LinkedIn photo, and message the target staff member. The phone number is new and unknown, but the profile feels familiar. That is the entire trick.
The 5-step script
The pattern repeats across cases reported through 2024, 2025, and 2026.
- The opener. A polite first message from an unknown number. “Hi, this is [Director Name]. I changed my number. Please save this.” Sometimes a casual question first: “Are you in office?” or “Free for a quick task?”
- The pretext. The director is in a meeting, on a flight, with an investor, in a hospital, or otherwise unable to take calls. This is the reason given for using WhatsApp instead of calling.
- The instruction. A vendor payment, a client refund, a statutory deposit, a personal urgent transfer that the director will reimburse later. Amounts vary from ₹50,000 in tests to over ₹1 crore in mature attacks.
- The urgency. The transfer must happen within the hour, before market close, before the office closes, before an investor meeting. Speed is the lever.
- The redirect. The bank account provided is in a third party’s name with an explanation: “vendor account is closed, use this routing account” or “personal account of our CA, please transfer there.” The receiving account is always a mule account, never a real vendor.
If you have received messages that look like this, you have already seen the scam. The defence is what you do next.
Why corporates are the target
Three reasons.
Volume of money flowing. Even small companies move lakhs in routine vendor payments every month. A single fraudulent transfer of ₹5 to 50 lakh fits inside normal operating cash flow and does not trigger immediate alerts.
Distributed authority. In most Indian SMEs and startups, finance staff are trusted to act on director instructions without a formal four-eyes approval flow. A WhatsApp message from the boss is treated as a valid instruction.
Public director identity. Funded startups and growing SMEs publicise their founders and leadership. LinkedIn profiles, podcast appearances, speaker bios, and press coverage make a director’s name and photo trivial to harvest.
The Indian Cyber Crime Coordination Centre (I4C) under the Ministry of Home Affairs has flagged business email compromise and WhatsApp-based CEO fraud as one of the fastest-growing corporate cybercrime categories. The I4C portal at cybercrime.gov.in accepts complaints under this category. CERT-In has issued multiple advisories on social engineering attacks targeting Indian companies through messaging platforms.
6 red flags any finance team can apply
Any one of these on its own is enough to pause and verify before acting. Do not wait for the second flag.
1. The message comes from a new or unknown WhatsApp number
The most basic tell. The director has an existing WhatsApp number that your team already uses. A message from any other number, no matter how convincing the photo, should be verified through a known channel before acting.
2. The director claims to have changed their number
Real number changes happen, but the standard response is the same. Call the old number. Email. Walk to the cabin if you are in office. Confirm on a second channel before treating the new number as authentic.
3. The instruction comes only on WhatsApp
Real finance instructions in a healthy company go through email, an internal ticketing system, or in-person approval. A founder who only ever talks on WhatsApp for urgent payments is unusual, and a founder who suddenly does that for the first time should trigger immediate verification.
4. The transfer is urgent and time-bound
Urgency is the universal scam ingredient. Real business payments almost never lose anything from waiting 15 to 30 minutes for verification. Any message that says it must happen before a meeting ends, before bank cutoff, or before an investor sees a statement is engineering pressure.
5. The account is in a third party’s name
Vendor payments go to vendor accounts. Statutory deposits go to government accounts. Any explanation that says use this personal account instead, or this routing account, is the most common single feature of the scam.
6. The director is conveniently uncontactable
In a meeting, on a flight, at a hospital, in court. Always a reason that prevents you from calling. If you cannot reach the director on the known number, that is itself the verification result. Escalate to a co-founder, the CFO, or a senior colleague.
What to do if you got the message
- Do not transfer. Pause. The scam survives on speed.
- Verify on a known channel. Call the director on the existing office or mobile number that your team already uses. Speak to them in person if you can. Email the official work address.
- Escalate if the director is unreachable. Go to a co-founder, the CFO, the CEO, or a senior colleague. No real transfer instruction loses anything from a 15-minute delay.
- Save evidence. Screenshots of the WhatsApp chat, the sender number, the profile photo, the account details provided, any audio messages. Do not delete the chat.
- Tell your IT or security team. This is a corporate incident, not a personal one. They need to know so they can warn other staff.
What to do if money already moved
Speed of reporting is the single biggest factor in fund recovery. Act in this order:
- Call 1930. This is the national cybercrime helpline operated 24/7 by I4C under MHA. They will guide you on next steps and initiate the bank-side hold process. (I4C FAQ)
- File a formal complaint at cybercrime.gov.in within 24 hours. This is required for any recovery action and creates the formal record.
- Notify your bank’s fraud team in parallel. Banks have fast-track escalation channels for ongoing cybercrime. The earlier they know, the better the chance of freezing the recipient account before the money is layered out.
- File an FIR with the local police cyber cell. This is needed for insurance claims, internal HR processes, and any subsequent legal action.
- Preserve all evidence. Chat exports, transaction screenshots, bank statements, any device logs. Do not delete or modify anything.
The Hyderabad ₹1.2 crore case surfaced 4 days after the transfers. Recovery would have been higher if the discrepancy had been caught within hours.
How to harden your finance process this week
Three changes, none of them require a tool purchase.
Mandate verbal verification for any transfer above a threshold. Pick a number that fits your business. For most Indian SMEs, ₹50,000 is reasonable. Any WhatsApp or email instruction for a transfer above that threshold must be verbally confirmed with the requestor on a known phone number before processing.
Maintain an internal directory of known director numbers. A simple list, updated quarterly, sent to all finance and operations staff. Any new number claiming to be a director is treated as unverified by default until cross-checked against this list.
Run an internal awareness session. Forward this article. Walk through the Hyderabad case in a 20-minute Friday meeting. Make it normal to pause and verify. The cultural permission to slow down is the strongest defence.
Sent or received a suspicious message? We verify free
If a WhatsApp message claiming to be your boss or anyone in authority feels off and you want a sanity check before doing anything, send it to us privately.
WhatsApp / Call: +91 99644 43350
Send a screenshot, the sender number, the profile photo, or whatever details you have. We tell you whether it is real or a scam, in plain language, with no charge.
What we do:
- Cross-check the sender number against known scam patterns
- Look for the boss impersonation script tells (new number, urgency, third-party account, only-WhatsApp insistence)
- Tell you what verification step to take next
What we do not do:
- Charge for the verification
- Ask for your bank details, OTPs, UPI PIN, or company financial data
- Pretend to be law enforcement or a banking authority
Verification is free. You can also email help@cybersecify.com with the same details.
How this differs from WhatsApp Ghost Pairing
We get this question often, so worth clarifying. The WhatsApp Ghost Pairing scam tricks you into linking your real WhatsApp account to a scammer’s device through a fake pairing code, after which they read your messages and impersonate you to your contacts. That attack compromises your actual account.
Boss impersonation does not touch your WhatsApp account at all. The scammer just creates a brand new WhatsApp profile using your boss’s photo and name, then messages your finance team from an unknown number. Two different attacks, two different defences. Worth understanding both.
For broader public awareness, also see our guides on digital arrest scams, fake DPDP notices, and the Karnataka citizen safety guide.
Save this number now
If anyone on your team receives a WhatsApp message claiming to be the boss or director with an urgent transfer instruction, the right move is to verify before acting. Save +91 99644 43350 in your phone now. During an active scam attempt, you will not have time to search.
Frequently asked questions
What is a WhatsApp boss impersonation scam?
A scammer creates a WhatsApp account using your director or CEO’s name and profile photo, then messages a finance or accounts staff member from an unknown number. They claim to be in a meeting or travelling, ask for an urgent fund transfer to a vendor or client, and pressure the staff member to act fast and avoid calling back. The money goes to a mule account.
How do scammers get the director’s photo and details?
Profile photos are usually scraped from LinkedIn, the company website, or news articles. Staff names and roles also come from LinkedIn, About Us pages, press releases, and leaked email lists. The scammer does not need to hack anything. Most of the data is already public.
What should finance staff do if they get a WhatsApp message from the boss on a new number?
Stop. Do not transfer any money. Call the boss on the known office number or speak to them in person. Verify on at least one channel other than WhatsApp. If the boss is unreachable, escalate to a co-founder, the CFO, or a senior colleague before acting. No real transfer instruction loses anything by waiting 15 minutes for verification.
Can we recover the money if a fraudulent transfer already happened?
Speed matters. Call 1930 immediately and file a complaint at cybercrime.gov.in within 24 hours. Notify your bank’s fraud team in parallel. Banks can sometimes freeze the recipient mule account within hours, but only if you report fast. The Hyderabad case surfaced 4 days later, which is one reason the loss was so large.
How is this different from the WhatsApp Ghost Pairing scam?
Ghost pairing is about scammers linking your WhatsApp to their device through a fake login code, which gives them access to your real account and conversations. Boss impersonation does not touch your account at all. The scammer just creates a new WhatsApp profile using a stolen photo and name. Two different attacks, two different defences.
Foundational reads. The anchors behind every guide on this site.
- The First Hour After Cyber Fraud in India. What to do in the first 60 minutes after you realise you have been scammed.
- Pause, Verify, Then Act. The universal three-rule defence against every scam type.
- Your Digital Footprint Is the Scam’s Raw Material. Why scammers already know your name, employer, and bank.