A sophisticated CEO fraud scheme that defrauded a Mumbai-based firm of ₹48.60 Lakh has culminated in the arrest of two operatives from Bihar and Jharkhand, exposing systemic vulnerabilities in mobile point-of-sale identity verification systems. The operation by the South Cyber Police of the Mumbai Crime Branch successfully froze and recovered the entire defrauded sum while seizing 161 fraudulently activated SIM cards. The crackdown highlights an expanding national ecosystem of illicit telecom infrastructure that enables executive impersonation scams across multiple states.
The case emerged on February 26, 2026, when a 43-year-old corporate employee received urgent WhatsApp messages originating from an unknown number displaying the photograph of his company’s director. Believing the payment instructions to be legitimate, the worker transferred ₹48,60,511 to designated bank accounts provided by the fraudsters before discovering the deception. Following an immediate formal complaint, law enforcement officials registered a case under relevant provisions of the Bharatiya Nyaya Sanhita and the Information Technology Act.
Anatomy of Executive Impersonation Scams
The Mumbai incident represents a classic execution of executive impersonation, commonly referred to as CEO or boss fraud, which relies heavily on psychological pressure rather than technical system breaches. Scammers leverage publicly available corporate rosters and executive photographs to construct convincing social media profiles, targeting finance personnel with high-priority monetary directives. The artificial urgency embedded in these instructions frequently deters employees from conducting routine internal checks.
Renowned cybercrime expert and former IPS officer Prof. Triveni Singh emphasized that visual markers such as display pictures fail to establish authenticity in digital communications. According to Singh, perpetrators exploit organizational hierarchies to bypass standard operational oversight, making independent verbal verification essential before initiating any financial transaction.
The reliance on direct digital messaging for corporate fund transfers has transformed messaging platforms into prime vectors for financial extortion. Forensic experts note that unless enterprises institute strict dual-authorization protocols for outward remittances, social engineering tactics will continue to breach corporate financial defenses.
Point-of-Sale Fraud and the Shadow Supply Chain
Digital forensics conducted by the Mumbai Crime Branch traced the mobile numbers used in the extortion to forged electronic Know Your Customer (e-KYC) activations. On August 14, investigators arrested 22-year-old Aamir Chand Mohammad Khan from Rukundipur in Siwan district, Bihar. Khan operated as an Airtel SIM distributor and Point of Sale operator, utilizing the specialized Telecom Mitra application to systematically compromise customer data.
Investigators revealed that Khan harvested personal details from unsuspecting subscribers under the pretext of porting their mobile connections to new networks. Instead of processing legitimate requests, he fraudulently activated multiple secondary SIM cards without customer consent. Khan subsequently sold batches of these activated connections for ₹6,000 to co-accused Suraj Kumar Pradeep Kumar Sav in Dhanbad, Jharkhand, receiving payments via Unified Payments Interface (UPI) transfers into his Airtel Payments Bank account. Sav was arrested on August 16.
Seizures from the joint operation included 161 active SIM cards, mobile handsets, and digital devices used for unauthorized activations. Cross-referencing data on the National Cyber Crime Reporting Portal linked the accused to at least seven active fraud cases spanning Mumbai, Punjab, Haryana, Delhi, West Bengal, and Tamil Nadu, underscoring the inter-state reach of the supply network.
Regulatory Overhaul and Institutional Safeguards
The deliberate misuse of point-of-sale credentialing systems has prompted the Union Government and the Department of Telecommunications to tighten regulatory frameworks surrounding mobile subscriber verification. Illegitimately acquired SIM cards constitute the fundamental operational backbone for cybercrime syndicates, enabling bad actors to obscure their digital footprints and operate mule bank accounts with relative anonymity.
To counter widespread identity misuse, the Centre has bolstered public digital safety initiatives through the Sanchar Saathi platform. The portal’s Telecom Analytics for Fraud Management and Consumer Protection (TAFCOP) feature allows citizens to track all active mobile connections registered under their Aadhaar identity, empowering subscribers to report and disconnect unauthorized SIM cards directly.
Law enforcement agencies strongly advise citizens to utilize the national cybercrime helpline 1930 immediately upon detecting financial fraud, as rapid reporting significantly raises the likelihood of freezing funds within the banking grid. Additionally, authorities caution individuals against allowing third parties to operate bank accounts registered in their names, reinforcing that stringent personal vigilance remains the primary barrier against modern cyber financial crime.
