Goa Police have identified a new cyber fraud method known as the ‘boss scam’, in which criminals impersonate senior company officials to deceive employees and gain access to sensitive business systems. A businessman from Mapusa has reportedly lost ₹2 crore, while the cybercrime cell has received three additional complaints linked to similar fraud.
How Does the Boss Scam Work?
According to PI Deepak Pednekar, cybercriminals pose as a company’s boss, senior officer or management representative and send employees a ZIP file with instructions to open it on an official computer. The message is designed to appear legitimate, often creating a sense of urgency by making the request seem to come directly from someone in authority. Employees who trust the sender may open the attachment without verifying whether the communication is genuine.
Police warned that opening such a file could compromise the computer and expose confidential business information. The file may contain malware capable of stealing login credentials, monitoring activity or establishing unauthorised access to the device. Once criminals gain access, they may use the stolen information to manipulate payment instructions, initiate unauthorised financial transactions or bypass security controls.
Investigators have warned that a single compromised computer can create risks beyond the employee who opens the file, particularly when the device is connected to other systems within an organisation.
What Happened in the ₹2 Crore Fraud Case?
The Goa cybercrime cell has detected the emerging fraud method following complaints involving corporate targets and businessmen. A businessman from Mapusa reportedly suffered a financial loss of ₹2 crore, making it one of the significant cases associated with the scam.
Police have also received three additional complaints connected to the same type of fraud. However, the available details do not establish the individual losses in those complaints or identify the precise sequence of transactions through which the Mapusa businessman lost his money.
The cybercrime cell has warned that criminals are exploiting the trust employees place in senior officials and using apparently routine workplace communications to create opportunities for financial fraud.
Why Are Corporate Computers Being Targeted?
Corporate computers can contain sensitive information, including employee credentials, business communications and payment-related records. By compromising these devices, cybercriminals may obtain information that can subsequently be used to authorise or manipulate financial transactions.
Pednekar explained that malicious attachments may allow attackers to monitor activity, establish unauthorised access or spread to other systems. The threat is particularly serious when employees act on instructions that appear to come from company management without confirming their authenticity.
Police have therefore emphasised the importance of verifying unusual requests, even when the sender appears to be a familiar senior official. The warning extends to messages received through email, WhatsApp and other communication channels used for business operations.
FCRF Launches CP-FRM to Build India’s Next Generation of Fraud Risk Professionals
What Precautions Have Police Recommended?
Police have advised employees to confirm unexpected requests involving ZIP files through a known telephone number or another trusted communication channel before opening attachments. They have also cautioned against bypassing antivirus software or other security controls simply because a message appears to come from a superior.
For financial transactions, the police have recommended dual authorisation and separation of duties to reduce the possibility of fraudulent payments being approved through a single compromised account or employee.
Pednekar specifically warned employees against relying solely on emails, WhatsApp messages or voice calls when authorising payments. Independent verification is necessary, particularly when payment instructions are unusual or urgent.
What Should Employees Do After Opening a Suspicious File?
Police have advised anyone who opens a suspicious ZIP file to immediately isolate the affected computer and inform the organisation’s IT or security team. Prompt reporting can help the organisation examine the device and assess whether other systems or sensitive information may have been compromised.
Employees have also been advised not to delete files or attempt their own investigation, as doing so could interfere with the examination of the incident.
Where payment details may have been compromised, the affected organisation should notify its bank and finance team. Cyber financial fraud should also be reported through the 1930 helpline.
How Serious Is Goa’s Wider Cybercrime Challenge?
The warning comes as Goa continues to face difficulties in detecting registered cybercrime cases. Police figures indicate that only 202 of the 556 cybercrime cases registered since April 2022 have been detected, representing a detection rate of approximately 36%.
Although the detection rate improved to 44% between January 2025 and August 2026, 171 of the 306 cases registered during that period were still awaiting detection.
The figures underline the challenges faced by investigators as cybercriminals adopt methods involving impersonation, malicious attachments and manipulation of workplace communications. The latest complaints demonstrate how criminals can exploit ordinary business practices to target organisations and individuals.
The420 Insight: A Message From the Boss Could Become a Financial Trap
The reported ₹2 crore loss in Mapusa highlights the financial consequences of trusting unverified instructions that appear to come from senior management. The scam does not necessarily begin with an obvious demand for money. It may begin with a seemingly routine request to open a file on an office computer. Independent verification, controlled access to company systems and dual approval for payments remain important safeguards against this form of cyber fraud.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
