A Hyderabad-based private company has fallen victim to sophisticated cyber fraud after an employee transferred ₹1 crore to fraudsters who impersonated the firm's owner through a fake WhatsApp message.
The incident once again has exposed the growing menace of business impersonation scams in India, where cybercriminals take advantage of trust, urgency and digital communication platforms to trick employees into carrying out illegal financial transactions. After the complaint was received, the Cyberabad Cyber Crime Police have opened a case and conducted a detailed investigation to identify the culprits and trace the stolen funds.
According to police officials, the complaint was filed by representatives of Maisamma Retail Private Limited, operated by Dilip Kumar, a resident of Nizampet in Hyderabad. The fraud took place after one of the company's employees received a WhatsApp message from an unknown mobile number.
The person said he was speaking on behalf of the company owner and asked the employee to immediately pay ₹1 crore. To make sure the request was authentic, the fraudster provided bank account details and stressed the urgency of the transaction.
So, confident that the message had been sent with the approval of the company owner, the employee accepted the payment without checking whether or not the instruction was made by him or her in person. Only after the transfer had been completed did the employee contact the sender for clarification. When no response was forthcoming, the matter was escalated to the management of the company.
When this transaction was disclosed to the company owner, he stressed that he had never issued that payment instruction and had nothing to do with the bank account that was mentioned in the WhatsApp message. That business soon realized that it was the victim of a sophisticated impersonation scam which was trying to take advantage of its internal payment system and employee trust.
When the fraud was discovered, the company approached Cyberabad Cyber Crime Police and filed a complaint against those individuals under the legal provisions. The investigating team is now investigating the case thoroughly, including digital evidence, communication records, bank account transactions and the movement of the transferred funds.
Police officials said investigators are examining beneficiary bank accounts used in the transaction, the mobile numbers associated with the fraudulent WhatsApp messages, and the digital footprint left by the suspects. Coordination has been initiated with the concerned banks to freeze suspicious accounts wherever possible and track the flow of the money before it can be withdrawn or diverted through multiple financial channels.
Based on initial information, the fraudsters probably focused on the payment approval process of the company. When attacking the company by impersonating a senior executive or business owner, cybercriminals are able to take advantage of the willingness of employees to respond to urgent financial needs from top management. Such attacks are becoming ever more common in all businesses of all sizes and are considered a form of Business Email Compromise (BEC) as well as Business Communication Compromise (BCC) even when done via a messenger like WhatsApp instead of email.
Cybersecurity experts say the fraudsters are using social engineering, a technique where criminals rely primarily on social engineering to manipulate human behavior rather than exploiting technical vulnerabilities. Fraudsters often create a false sense of urgency, telling employees to move fast to complete the transaction without checking their own personal or sensitive transaction in a secure manner and without verifying the request through their own internal channels.
The Hyderabad case is another reminder that businesses are increasingly becoming attractive targets for cybercriminals. Organizations using WhatsApp, email and messaging apps to communicate in daily life are increasingly becoming dependent on cybercriminals’ tactics to exploit these trusted platforms. Fake profiles, cloned mobile numbers, image imitations and spoofed communications have become common tools to defraud victims.
Company cybersecurity professionals suggest that companies establish financial approval mechanisms in place to ensure that payments are approved and verified at multiple levels before settling high-value payments. It is recommended that employees verify any payment requests received through messaging applications by directly calling the concerned executive using previously verified contact numbers.
Organizations should also have dual authorization systems in place as well as payment approval workflows and cybersecurity awareness training to reduce the possibility of such fraud.
Law enforcement agencies in India have repeatedly warned businesses and individuals against acting solely on digital messages requesting financial transactions. Real company executives would not simply ask for the transfer of funds through messaging applications without following established financial protocols, the officials said. Any request for large payments, changes in beneficiary bank accounts or urgent transfers should immediately raise suspicion and be independently confirmed.
The Cyberabad Cyber Crime Police are still investigating if the accused are part of a larger cybercrime network that operates worldwide. Financial records, telecom data, internet protocol data, and other digital evidence are being collected to determine the identity of those behind it. Similar impersonation attacks could have taken place in other businesses using similar tactics, authorities said.
Cyber experts say organizations should periodically review employee awareness regarding phishing, impersonation attacks, fake payment instructions, and social engineering techniques. Regular cybersecurity drills, internal audits, and clearly defined financial approval processes can significantly reduce the risk of successful cyber fraud.
The latest incident highlights how cybercriminals continue to evolve their tactics, exploiting trusted communication channels to carry out high-value financial fraud. While technology offers convenience and efficiency, it also requires greater vigilance from businesses and employees alike. Verification, internal controls, and cybersecurity awareness remain the strongest defenses against increasingly sophisticated impersonation scams.
The Cyberabad Cyber Crime Police are continuing the investigation and are trying to track the stolen funds, identify the accused involved, and prevent further financial losses. Companies need to stay alert and report suspicious correspondence immediately, emphasizing that timely reporting can significantly improve the chances of recovering funds and disrupting cybercriminal networks.
Comments
Please to leave a comment on this article.