SEBI Issues Alert on 'Boss Scam' Targeting Corporate Executives in India

MUMBAI — The Securities and Exchange Board of India (SEBI) issued a formal warning Thursday regarding a surge in cyber fraud schemes targeting corporate employees, urging organizations to heighten vigilance against impersonation tactics known as the "boss scam." The regulator's alert comes amid rising instances where criminals pose as chief executive officers or senior executives to manipulate staff into authorizing unauthorized fund transfers.

The scheme typically involves fraudsters gaining access to internal communication channels or utilizing spoofed email addresses that mimic those of high-ranking company leaders. Once established, the impersonators send urgent requests to finance personnel or administrative staff, demanding immediate wire transfers for confidential deals, vendor payments, or emergency acquisitions. The urgency and authority attributed to the fake executives are designed to bypass standard verification protocols.

SEBI highlighted that these incidents have increased significantly across India's financial hubs, with Mumbai serving as a primary focal point due to its concentration of corporate headquarters and stock exchanges. The regulator emphasized that the sophistication of these attacks has evolved, making it difficult for employees to distinguish between legitimate directives and fraudulent instructions without rigorous cross-checking.

In its advisory, SEBI called on listed companies to reinforce internal controls regarding financial transactions. The board recommended implementing multi-factor authentication for all payment approvals and establishing a mandatory secondary verification process for any transfer requests initiated via digital communication channels that deviate from established norms. Companies are advised to train employees specifically on identifying the hallmarks of these impersonation attempts, such as pressure tactics, unusual urgency, or requests for secrecy.

The warning follows a broader trend in cybercrime where social engineering is used to exploit trust within organizational hierarchies. Unlike traditional hacking methods that rely on technical vulnerabilities, this approach targets human psychology and procedural gaps. SEBI noted that the financial losses from such incidents can be substantial, impacting not only individual companies but also investor confidence in market integrity.

While the regulator has issued clear guidelines for prevention, it acknowledged that fraudsters continue to adapt their methods rapidly. The advisory does not specify a single recent high-profile case triggering the alert but cites an aggregate increase in reported attempts over the past quarter. As of Thursday afternoon, no specific timeline was provided regarding when these fraudulent activities began or if any major corporations have already suffered significant losses due to this specific wave of attacks.

Industry observers note that as remote work and digital communication become more entrenched, the risk surface for such impersonation scams expands. The effectiveness of SEBI's warning will depend on how quickly corporate governance structures can adapt their internal protocols without hampering operational efficiency. Questions remain regarding the extent of current exposure among mid-sized firms and whether existing cybersecurity frameworks are sufficient to counter these evolving social engineering threats.