SEBI warns regulated firms of AI-driven "Boss Scam" targeting finance executives

India's Securities and Exchange Board (SEBI) has issued a cybersecurity advisory warning regulated entities and listed companies about a growing CEO impersonation scheme known as the "Boss Scam," following intelligence shared by the Indian Cyber Crime Coordination Centre (I4C).

According to the advisory, fraudsters impersonate chief executives or other senior executives through email, WhatsApp, Microsoft Teams and other communication platforms to instruct finance staff to transfer funds to fraudulent bank accounts. Criminals are increasingly using AI-powered deepfake technology, including voice cloning and fake video calls, to make these requests appear legitimate.

SEBI also highlighted a second attack method involving malicious ZIP files containing executable malware. Once opened, the malware can hijack active WhatsApp Web sessions or compromise a victim's device, enabling attackers to impersonate finance personnel or alter contact lists so that fraudulent numbers appear under trusted executive names. The attackers then use the compromised accounts to request urgent fund transfers.

To mitigate the risk, SEBI urged regulated entities to independently verify payment instructions received through digital communication channels by contacting the purported sender directly. Firms were also advised not to execute payment requests based solely on messages, avoid opening executable files without verification, regularly log out of unused WhatsApp Web sessions, and promptly report suspected incidents through India's national cybercrime reporting channels.

The advisory reflects growing concern over the use of artificial intelligence and social engineering in financial fraud, as cybercriminals increasingly target corporate executives and finance teams with sophisticated impersonation techniques aimed at bypassing internal payment controls.