A general manager at a private Mumbai company transferred ₹1.98 crore within minutes after receiving what appeared to be an urgent payment instruction from his own director on WhatsApp. The message was not from the director at all, but the fraud unravelled quickly enough for police to recover nearly 92 per cent of the money, a recovery rate investigators are calling a template for how such cases should be handled.
The incident occurred on August 6, 2026, when the employee received messages from an unfamiliar mobile number carrying the company director’s name and profile photograph. Believing the instructions came directly from senior leadership, he followed the demand to transfer ₹1.98 crore to a specified account without pausing to verify the request through any other channel.
A familiar face, a fabricated identity
Police say the fraudsters told the employee an urgent payment needed to be made immediately, supplying bank account details and pressing for speed. Because the WhatsApp profile displayed the director’s genuine name and photograph, the employee reportedly saw no reason to doubt the message’s authenticity and completed the transfer as instructed.
The deception surfaced only after the transaction had gone through, when the employee contacted the actual director through his known official number to confirm the payment had been processed. The director clarified he had sent no such message and had authorised no transfer, at which point the employee realised the WhatsApp account contacting him had been fraudulently created using his superior’s identity.
This pattern, now widely referred to in India as the “boss scam,” has escalated sharply over the past year. India’s Cyber Crime Coordination Centre issued a national advisory in June warning organisations about an evolved version of executive impersonation fraud that exploits WhatsApp rather than traditional email, describing cases in which malware compromises an executive’s device and hijacks active WhatsApp Web sessions to send fraudulent instructions that appear to come from a genuine, trusted account. The Securities and Exchange Board of India followed with its own caution to listed companies the following month, after the coordination centre flagged a growing trend of impersonation carried out over WhatsApp, Microsoft Teams and other messaging platforms.
Ninety-two per cent recovered through speed
What distinguishes the Mumbai case is less the fraud itself than the response that followed it. The victim contacted the Mumbai Police cyber fraud helpline, 1930, and approached the Cyber Police Station in the South Division almost immediately after discovering the deception. That prompt reporting allowed police to begin tracking the financial trail and coordinate with banks before the money could be dispersed further.
The intervention secured ₹1,83,03,492, representing close to 92 per cent of the total amount transferred. Police have repeatedly stressed that the earliest hours after a fraudulent transaction are the most critical window for recovery, since delayed reporting typically allows money to be split across multiple accounts and moved through several layers, making it far harder to trace or freeze.
The scale of losses from this category of fraud nationally underscores why that speed matters so much. A related case saw roughly ₹7.8 crore lost by a prominent businessman’s firm to a similar messaging-app impersonation scheme targeting a chief financial officer, illustrating that neither corporate seniority nor institutional resources offer full protection against a scam built on exploiting trust in a familiar name rather than technical vulnerabilities.
Verification, not identity, is the real safeguard
Mumbai Police have used the case to reiterate a message aimed squarely at corporate finance teams: a name and photograph appearing on WhatsApp, Telegram or any messaging platform is not proof that a message originates from the person it claims to represent. Employees receiving payment instructions from a new or unfamiliar number are advised against transferring money without independently confirming the request through a previously known number or an established company communication channel.
Investigators note that fraudsters deliberately manufacture urgency, using language such as demands to act immediately or references to confidential transactions, to prevent recipients from pausing to verify. That psychological pressure remains the core mechanism behind the boss scam’s continued success across Indian companies.
Police have urged victims of similar fraud to call the 1930 helpline without delay or file a complaint through the National Cyber Crime Reporting Portal, noting that early reporting substantially improves the odds of tracing and freezing transferred funds. The Mumbai case, officers said, demonstrates both how convincingly such scams can be engineered and how much of the damage can still be reversed when reporting happens fast enough.
