Pune Cyber Police have arrested five people in an investigation into a ₹1.95 crore whale-phishing fraud that targeted a Kothrud-based real estate company by impersonating one of its partners on WhatsApp.
Police said the suspects were allegedly connected with cybercrime operators in China and were involved in handling or moving money transferred by the company’s accounts manager. The arrests follow months of financial and technical investigation into the February fraud.
The case began when the company’s 37-year-old accounts manager received messages from a WhatsApp number displaying the photograph of one of the firm’s partners.
Believing that the instructions were genuine, he made two large transfers totalling ₹1.95 crore.
Proposal for Conducting Cyber Crisis Drill, Tabletop Exercise (TTEx) & CCMP Readiness Exercise
Fake WhatsApp profile triggered two major transfers
According to police, the first message appeared routine.
The sender asked the accounts manager whether he had reached the office and then instructed him to transfer ₹95 lakh for an ongoing project in Kothrud.
The employee transferred the money to the bank account provided in the message.
A few hours later, the same sender allegedly asked for another ₹1 crore.
When the accounts manager raised a question about Tax Deducted at Source, the impersonator reportedly assured him that the tax issue would be taken care of. The second payment was then made.
The fraud came to light only when the sender asked for another ₹1.9 crore.
At that point, the accounts manager contacted the actual partner through his landline and discovered that he had never instructed him to make the earlier transfers.
Police then contacted the banks that had received the ₹1.95 crore and began tracing the money.
Bank records helped identify alleged gang members
Investigators examined beneficiary accounts, email addresses, mobile numbers and transaction trails to identify people allegedly connected with the funds.
Police said the money moved through multiple bank accounts after the initial transfers.
That layered movement is commonly used in cyber fraud to make it harder for banks and investigators to freeze stolen money before it is withdrawn or transferred again.
The investigation eventually led police to five suspects who allegedly had roles in receiving, transferring or handling the funds.
Pune Cyber Police said the accused were also in contact with operators in China.
The exact role of the China-based individuals has not yet been publicly detailed, and investigators are continuing to examine how instructions and money moved through the alleged network.
Police are also trying to establish whether the same gang targeted other companies.
What whale phishing means
Whale phishing is a highly targeted form of phishing aimed at people who control money or sensitive information inside an organisation.
Instead of sending thousands of generic fake emails, criminals research a specific company and impersonate a senior executive, director or business owner.
The attack is also known as CEO fraud or a business email compromise-style scam.
In the Pune case, criminals allegedly relied on a WhatsApp profile carrying the company partner’s photograph.
That was enough to create an initial sense of familiarity.
Police say similar attacks can also use spoofed emails, Microsoft Teams messages, compromised phones or hijacked messaging sessions.
The fraud therefore does not necessarily require attackers to break into the company’s core banking system.
They simply need to convince the employee who is authorised to make the payment.
Pune has seen repeated executive-impersonation attacks
The latest case is part of a broader pattern in Pune.
Earlier this month, a Pune-based sugar trader lost ₹3 crore after fraudsters allegedly compromised an accountant’s phone and impersonated the trader through WhatsApp. Three transfers of ₹1 crore each were made before the fraud was detected.
In April, another Pune company lost ₹70 lakh in a more sophisticated variant in which attackers allegedly manipulated the accountant’s phone contacts and continued conversations inside an existing WhatsApp thread while impersonating the company CEO.
Police say Pune City and Pimpri Chinchwad have together recorded close to a dozen whale-phishing cases since 2022.
The repeated incidents show why profile photographs and familiar names can no longer be treated as proof that a payment request is genuine.
A criminal may know the name of a director, understand an ongoing project and reproduce the language typically used inside the business.
For companies, the strongest defence is therefore procedural rather than visual.
Large transfers should require an independent confirmation through a previously verified phone number, preferably along with a second approval from another authorised employee.
What this means for you: Never approve a large business payment solely because a WhatsApp profile, email address or display photograph looks familiar. Any unusual or urgent transfer request from a senior executive should be verified separately through a known phone number or an internal approval process.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
