Mumbai, July 17 (IANS). Capital markets regulator SEBI (Securities and Exchange Board of India) on Friday advised listed companies and entities under its regulation to be cautious of an emerging cyber fraud named ‘Boss Scam’. In this fraud, cyber criminals impersonate CEO (Chief Executive Officer), MD (Managing Director) or other senior officials and cheat employees into transferring money.
This advisory has been issued after the Indian Cyber Crime Coordination Center (I4C) reported increasing cases of CEO and MD impersonation fraud targeting companies. These frauds are being carried out through email, WhatsApp, Microsoft Teams and other social media platforms.
According to SEBI, the fraudsters pose as senior officials of the company and give immediate instructions to the finance or accounts department employees to transfer money to the designated bank accounts.
“Fraudsters impersonate CEOs or other senior officials and contact their subordinates or associates through email or WhatsApp. The messages sent through email, WhatsApp, Microsoft Teams or other social media platforms ask them to follow instructions, resulting in transfer of funds to the accounts of the fraudsters,” SEBI said in its advisory.
In some cases, cyber criminals also use Artificial Intelligence (AI) based techniques like voice cloning and deepfake video calls to make their identities look like real officials and employees are easily duped.
SEBI has also warned about another method of fraud. Under this, criminals send ZIP files, in which malware is hidden.
If an employee opens this file on a Windows device, this malware can take over the active session of WhatsApp Web. After this, cyber criminals can send fake payment instructions to the finance team using the victim’s WhatsApp account.
The regulator also said that fraudsters sometimes tamper with the contact list of a device and save their mobile number in the name of CEO or MD. In such a situation, their calls or messages appear to the employees as coming from the real officer.
To avoid such incidents, SEBI has advised companies and regulated entities not to accept any fund transfer instructions received through email, WhatsApp or other social media platforms without verification. Be sure to confirm the instructions by contacting the concerned senior officer directly through a trusted medium.
SEBI has also said that no fund transfer should be approved solely on the basis of messages received on social media platforms. Also, fully verify the identity of the sender before opening or installing any executable or compressed file.
Additionally, the regulator has advised organizations to regularly logout from inactive sessions of WhatsApp Web to reduce the risk of account hacking.
–IANS
DBP
