Boss Scam in India: How Fake RBI and MCA Files Can Hijack WhatsApp and Steal Company Money

Why Is It Called the "Boss Scam"?

Because the criminal doesn't necessarily need to convince you that they are legitimate — they make you believe that your boss is legitimate.

The attacker may compromise the WhatsApp account or Web WhatsApp session of a senior executive, then use that genuine-looking account to send instructions to accountants, finance managers, CFOs, office administrators, HR or operations teams, and other employees who can authorise payments.

The employee sees a familiar account and thinks "sir/ma'am has asked me to do this." That's the trap.

How the Boss Scam Works

Step 1: The Attacker Targets a Senior Employee

The target may be a CEO, managing director, CFO, company director, chartered accountant, finance head, or senior manager. I4C has reported incidents involving professionals and businesspersons across multiple states, including Delhi, Gujarat, Maharashtra and Rajasthan.

Step 2: A Fake Urgent Message Arrives

The attacker may send a message pretending to be from RBI, the Ministry of Corporate Affairs, a bank, a regulator, a compliance department, an auditor, or another trusted business entity. I4C has also identified emails impersonating the Income Tax Department.

The message creates urgency — "Important: Regulatory compliance document attached. Immediate action required," or "Statement of Account – July 2026," or "RBI Compliance Notice – Urgent." The objective is simple: make the victim open the file without thinking.

Step 3: The Dangerous File Is Opened

I4C has warned about malicious compressed files such as "Statement of Account.zip" (often with a date prefix, e.g. "0714 Statement of Account.zip"), "RBI.zip," or "MCA.zip." The archive contains a malicious Windows executable (.exe) along with a Dynamic Link Library (.dll) file. To an ordinary user, it may look like a harmless business document — but it isn't.

Step 4: Malware Compromises the Computer

Once the malicious executable is run on a Windows computer, it installs a Trojan. I4C's technical analysis found the campaign uses DLL sideloading, a technique that helps the malware evade detection.

One particularly dangerous target is an active WhatsApp Web session. If the attacker gains control of that session, they may be able to operate through the victim's WhatsApp account. The malware can also automatically forward the same malicious file to the victim's contacts and WhatsApp groups — often with messages asking recipients to forward it to their company's finance manager "for verification," helping it spread further through corporate networks.

Now the scam changes completely. It is no longer "someone is pretending to be your boss" — it becomes "someone is communicating using your boss's compromised account."

Step 5: The Attacker Becomes the "Boss"

This is where the real financial fraud begins. The attacker may message employees with instructions such as "Please transfer ₹18 lakh to this account," "This payment is confidential, don't discuss it with anyone," or "I am travelling right now, process this immediately." The employee sees the familiar WhatsApp account and may not suspect anything.

Step 6: Money Moves to Mule Accounts

The money is typically directed toward accounts controlled by fraud networks or mule accounts. I4C has separately identified mule accounts as a major challenge in combating cyber-enabled financial fraud. Once money moves through multiple accounts, recovering it can become significantly more difficult.

Why This Scam Is So Dangerous

Traditional phishing often tries to make you trust the attacker. The Boss Scam takes a more sophisticated route: it abuses an existing trust relationship. You already trust your boss, and your boss's authority over your finance team. The attacker simply tries to insert themselves into that trusted communication chain. That's why this isn't just a malware problem — it's also a business-process problem.

The "Urgency + Authority" Trap

The Boss Scam usually combines two psychological triggers: authority ("Director has instructed this") and urgency ("Do this today"). Put them together and the employee may skip normal verification — exactly what the attacker wants.

Warning Signs to Watch For

Be especially careful when a senior executive suddenly asks you to:

• Transfer money to a new bank account
• Make an unusually large payment
• Bypass the normal approval process
• Keep a transaction confidential
• Ignore another authorised signatory
• Make payment immediately
• Download a regulatory document
• Open an unexpected .zip file or .exe file
• Disable security software
• Continue the conversation only through WhatsApp

One unusual request doesn't prove fraud. Multiple warning signs together should trigger verification.

The Most Dangerous File Names

Don't trust a file simply because its name looks official. Examples in the I4C advisory include "Statement of Account.zip," "RBI.zip," and "MCA.zip." The problem isn't the filename — it's what is actually inside the archive. A file called "RBI_Compliance.zip" doesn't become safe because it contains the word "RBI."

What Should Businesses Do Instead?

1. Never Execute Unexpected Files

Especially .exe, .bat, .cmd, .scr, suspicious installers, or unknown files inside .zip archives. If a regulatory or banking document is genuinely expected, verify it through the organisation's established channel. Regulators such as the RBI never distribute software updates, security fixes or account statements through WhatsApp attachments.

2. Never Approve a Payment Only Because the Boss Asked on WhatsApp

Create a simple rule: WhatsApp can request. WhatsApp cannot authorise. For high-value payments, require verification through another trusted channel — WhatsApp request → phone call to known number → confirm → payment. Don't call a number provided in the suspicious message; use the executive's previously known number.

3. Use a Two-Person Approval System

For significant payments, one person should not be able to complete the entire process. A simple system: request → verification → approval → payment. This creates friction for the fraudster, and in financial security, a little friction can save a lot of money.

4. Verify Unusual Requests Verbally

If the CFO suddenly asks for ₹25 lakh to be transferred to a new beneficiary, don't reply "Sure sir." Call and ask: "Sir, I received a request to transfer ₹25 lakh to XYZ account. Please confirm." That 20-second call could stop a multi-lakh fraud.

5. Keep WhatsApp and Computers Protected

Businesses should ensure WhatsApp two-step verification is enabled, unused WhatsApp Web sessions are logged out, Windows security updates are installed, antivirus/endpoint protection is active, employees cannot casually execute unknown files, business-critical systems have restricted software installation, and payment approvals follow documented procedures. Regularly review linked devices in WhatsApp (Settings → Linked Devices) and log out of sessions no longer in active use.

💡 AsliReview Tip

Never verify a payment request through the same channel that delivered it. If the request came through WhatsApp, verify by phone. If it came through email, verify through the company's internal system or a known phone number. If it came through a phone call, verify independently through another trusted channel. The golden rule: one channel can inform you — a second trusted channel should confirm it.

Reality Check: "But the WhatsApp Number Belongs to My Boss."

That doesn't make the payment request safe. A compromised account can look completely normal — the profile picture may be the same, the name may be the same, the chat history may be present, the number may be the same. The account can be real while the person controlling it is not. This is why identity verification and transaction verification are two different things.

The AsliReview 30-Second Payment Rule

Before approving an unusual payment, ask these five questions:

• Did the request come through an unusual channel? If yes, stop.
• Is the amount unusual? If yes, stop.
• Is the beneficiary new? If yes, stop.
• Am I being pressured to act immediately? If yes, stop.
• Have I independently confirmed the request? If no, do not pay.

What If You Already Opened the File?

Don't panic, but don't ignore it. Immediately:

• Disconnect the computer from the internet if appropriate for your organisation's incident-response procedure
• Inform your IT/security team
• Do not continue using the affected system for financial operations
• Check active WhatsApp Web/linked-device sessions from a trusted device
• Change important credentials from a clean device if instructed by your security team
• Review recent banking and payment activity
• Preserve suspicious files, messages and screenshots as evidence
• Report financial fraud immediately if money has already moved

Do not simply delete the suspicious file and assume the problem is solved.

What If Money Has Already Been Transferred?

Act immediately. For financial cyber fraud in India, call 1930 as soon as possible. You can also report the incident through the National Cyber Crime Reporting Portal.

The government's Citizen Financial Cyber Fraud Reporting and Management System (CFCFRMS) is designed to enable immediate reporting and help stop the movement of fraudulent funds — reported figures put savings at over ₹11,158 crore across more than 32.80 lakh complaints as of 30 June 2026. Every minute matters — don't wait for your bank's normal complaint process to finish before reporting a cyber financial fraud.

A Simple Corporate Rule Worth Adopting

Every company should have a written rule like this: "No employee may execute a high-value or unusual payment request received solely through WhatsApp, SMS or email. Independent verification is mandatory."

Put it in the company's payment SOP. Train employees on it. Repeat it regularly. Cybersecurity isn't only about firewalls — sometimes it's about teaching an accountant when to make one phone call.

Common Mistakes

• "It's from my boss, so it must be genuine" — not necessarily
• "The WhatsApp profile picture is correct" — that proves very little
• "The message sounds exactly like my boss" — attackers can study communication patterns
• "The file says RBI/MCA" — a filename isn't authentication
• "I'll just open it and see what it is" — that's exactly what the attacker wants
• "The payment is urgent, so I shouldn't delay" — urgency is often the weapon
• "We have antivirus, so we're safe" — security software helps, but it cannot replace good payment controls

Verification Checklist for Finance Teams

Before processing an unusual payment:

• Confirm the request independently
• Call the requester using a known number
• Verify the beneficiary
• Check whether the bank account is new
• Follow normal approval procedures
• Don't bypass dual approval
• Don't open unexpected executable files
• Don't trust compressed files just because they look official
• Check WhatsApp linked devices if compromise is suspected
• Report suspicious activity to IT/security immediately

The Bigger Lesson

The Boss Scam shows how modern fraud is changing. The attacker doesn't always need to steal your password directly — they may first compromise a device, then a communication channel, then a trusted identity, then a business process, then the company's money. That's a much more powerful attack chain, and businesses need to defend every step.

AsliReview's Golden Rule

Never approve money because a message looks authentic. Verify who asked, what was requested, where the money is going, why it is urgent, and whether the request was independently confirmed. If even one of those answers feels wrong, stop the transaction.

Frequently Asked Questions

What is the Boss Scam?

The Boss Scam is a form of CEO or senior-executive impersonation fraud in which criminals compromise or impersonate a senior employee and then instruct other employees to make fraudulent payments.

Who is usually targeted?

CEOs, directors, CFOs, accountants, finance professionals and other employees with access to business payments can be targeted.

How do attackers compromise WhatsApp?

I4C has warned about malware delivered through malicious files that can compromise Windows devices and active Web WhatsApp sessions, using a technique called DLL sideloading to evade detection.

Can a genuine WhatsApp account be used for fraud?

Yes. If an account or active session is compromised, attackers may use it to communicate with the victim's contacts, and the malware can even auto-forward itself to spread further.

Is every RBI or MCA attachment dangerous?

No. The warning is not that every RBI or MCA document is malicious. The danger is opening unexpected files from unverified sources, especially executable content disguised as business or regulatory documents. Regulators like RBI never send account statements or software updates through WhatsApp attachments.

What should I do if I receive a suspicious file?

Don't open it. Report it to your IT/security team and independently verify the communication.

What if money has already been transferred?

Report the financial cyber fraud immediately through 1930 and the National Cyber Crime Reporting Portal.

The AsliReview 5-Second Rule

Before opening a business file received unexpectedly: STOP → CHECK → VERIFY → OPEN.

If the file is unexpected, don't open it. If the request involves money, don't approve it without independent verification. If someone says "it's urgent," your response should be "I'll verify it first." That one sentence can save a company lakhs — or crores.