HDFC Bank Urges Citizens to Stay Vigilant Against ‘Boss Scam’

HDFC Bank has cautioned businesses and employees about a growing form of impersonation fraud known as the “Boss Scam”, in which criminals pose as senior executives or trusted colleagues to manipulate employees into transferring money or sharing sensitive information.

According to the bank, fraudsters typically approach employees through email, social media or messaging platforms while impersonating senior company executives, including CEOs and other top-level officials. In some cases, they may also pose as regulators and claim that the organisation has violated a regulatory requirement.

The messages are designed to create urgency and pressure the recipient into acting without carrying out normal verification.

The bank said fraudsters may send a ZIP file presented as a compliance or security document. Opening the file can allegedly install malware on the device, allowing criminals to compromise the executive’s laptop or mobile phone and gain access to their genuine messaging account.

Once an account has been compromised, the fraudsters can use it to contact finance or accounts personnel and issue apparently genuine instructions for urgent, high-value payments.

In some cases, according to HDFC Bank, criminals may even save their own phone numbers under the CEO’s name on the compromised device, making subsequent fraudulent instructions appear authentic.

Manish Agrawal, Senior Executive Vice President, Credit Intelligence and Control, HDFC Bank, said the fraud combines social engineering, malware and impersonation to target organisations and their authorised signatories.

“The fraudsters are using Boss Scam incidents to defraud organisations where the employees from the accounts department are induced to make payment on pretext of fake instructions received from the senior executive of the organisation,” Agrawal said.

He said organisations should strengthen controls over software installation, conduct regular employee awareness programmes and ensure that payment requests are independently verified before transactions are processed.

The bank has advised employees to independently verify any urgent payment instruction or request to change a beneficiary account by directly contacting the executive concerned through a known telephone number or through face-to-face confirmation.

It has also advised users not to download or install unknown ZIP or executable files received through unfamiliar sources and to keep operating systems and malware detection tools updated.

Companies have been advised to enforce software restriction policies on organisational devices to reduce the possibility of malicious programmes being installed.

Customers who receive suspicious calls or messages can report them through the Chakshu facility on the Sanchar Saathi platform or through the Sanchar Saathi mobile application.

HDFC Bank has further advised victims who have already made an unauthorised transaction to immediately inform their bank so that the relevant payment channels, including cards, UPI or net banking, can be secured against further losses.

Victims have also been advised to report financial cyber fraud by calling 1930 and to file a complaint through the National Cyber Crime Reporting Portal.

The bank’s warning highlights a key vulnerability in executive impersonation scams: a payment instruction appearing to come from a senior official should not be treated as genuine merely because it arrives through an apparently authentic corporate or messaging account. [KNT]

© Kashmir News Trust (KNT). Unauthorized use without attribution is prohibited.