Cybercriminals are making financial fraud through identity impersonation increasingly sophisticated. Fraudsters are using WhatsApp, email, Microsoft Teams and SMS to pose as company CEOs, owners, senior executives or colleagues and persuade employees and business operators to transfer money directly.
These scams combine technical deception with psychological pressure. Messages are carefully designed to make recipients believe that the request has come from a familiar colleague or senior executive and must be acted upon immediately.
Victims are often pressured to complete the payment before they have an opportunity to independently verify the instruction.
How Do Fraudsters Impersonate Senior Executives?
The fraud typically begins with a message that appears to come from a senior executive or someone known to the recipient. Criminals can create fake WhatsApp profiles, use email addresses resembling those of company officials, or copy corporate logos and other identifying elements to make their communication appear genuine.
In many cases, scammers use the same name and profile photograph as the person whose identity they are impersonating. This can make employees or business operators accept the message as genuine without conducting additional checks.
The criminals then issue instructions for immediate payment. Victims may be asked to settle a pending invoice, complete a business payment or transfer money to a new bank account or beneficiary.
Algoritha Security Launches ‘Make in India’ Cyber Lab for Educational Institutions
Why Do Scammers Pressure Victims To Pay Immediately?
The most common tactic in such messages is a demand for immediate action. Fraudsters deliberately create a situation in which the victim has little time to verify the request. They may suggest that a delay could disrupt company operations or affect an important business transaction.
The tactic can be particularly effective against employees who have access to corporate payment systems or financial transactions. However, individuals can also become victims of identity-impersonation scams.
Once money reaches an account controlled by the criminals, it can quickly be transferred through multiple bank accounts. This can make it more difficult to trace the final destination of the funds and reduce the chances of recovery.
Why Should Bank Detail Changes Be Verified?
Financial requests involving urgent payments or changes to bank account information should never be acted upon without independent verification. If a senior executive sends a payment instruction through WhatsApp or email, employees should not simply reply to the same message to confirm it. Instead, they should contact the executive through a separate, previously known communication channel.
For example, employees can call the executive directly using a phone number already available in company records and confirm whether the payment instruction is genuine. Email addresses should also be verified independently rather than relying solely on the address contained in the suspicious message.
Any request to change a bank account or beneficiary should receive additional verification before a payment is made.
Can A Profile Photo Or Name Confirm Someone’s Identity?
Cybercriminals can easily copy profile photographs, display names and email identities. Therefore, a person’s identity should never be confirmed solely on the basis of a photograph, name or email address.
Users should also never share OTPs, passwords, PINs, banking credentials or other sensitive information. Even when such information is requested in the name of legitimate business communication, the request should be independently verified.
Renowned cyber crime expert and former IPS officer Prof. Triveni Singh said identity-impersonation scams increasingly exploit a victim’s trust and urgency rather than relying solely on sophisticated technology. According to him, even when a financial request appears to come from a senior executive, employees should independently verify both the identity of the sender and the payment instruction before transferring money. Requests involving sudden payments, new beneficiaries or changes to bank details should receive additional scrutiny.
Companies can reduce the risk by introducing two-step verification for financial payments. Large or unusual transactions should require independent confirmation at a senior level and compliance with established internal procedures, helping employees avoid making decisions under pressure.
How Can Companies Prevent Executive Impersonation Fraud?
Future Crime Research Foundation (FCRF), an organisation working in cyber security and digital crime research, focuses on areas including cyber security, digital crime, fraud risk management, cyber law and cyber forensics, along with research, training and capacity building. The organisation is associated with an IIT Kanpur-incubated initiative.
Independent verification of identity and financial instructions is particularly important in impersonation-based fraud. When an unexpected payment request arrives in the name of a senior executive, employees should verify it through a previously established phone number or the company’s official communication system. Requests involving changes to bank accounts or beneficiaries should never be accepted without additional verification.
What Should Victims Do After Suspected Fraud?
Anyone who believes they have been targeted by an identity-impersonation scam or has accidentally transferred money to fraudsters should contact their bank immediately. In India, cybercrime complaints can be filed through the National Cyber Crime Reporting Portal. Victims of financial cyber fraud should also contact the 1930 helpline without delay.
The sooner a complaint is reported, the better the possibility of preventing suspicious transactions from moving further or getting funds frozen. Victims should preserve messages, emails, phone numbers, bank transaction details and other digital evidence that may help investigators trace the fraud.
The simplest way to protect against identity-impersonation fraud is to stop, verify and then pay. No matter how genuine a financial request from a senior executive may appear, spending a few minutes to independently confirm the instruction can prevent a major financial loss.
About the author — Ayesha Aayat writes on cybercrime, digital safety, and emerging online threats. Her work focuses on public awareness, legal clarity, and technology-driven risks.
