The Securities and Exchange Board of India (SEBI) has issued a new warning to companies and market participants about a growing cybercrime known as the ‘Boss Scam’ that has already caused many companies worldwide to lose millions of dollars. The regulator has called on companies to strengthen internal controls and employee awareness as cybercriminals continue to target corporate executives and finance teams.
The scam usually starts with what appears to be a legitimate message from a company’s CEO, managing director or another senior executive. The message usually carries an air of urgency and tells the employee usually in finance, accounting or treasury to immediately transfer funds, process a payment or share sensitive financial information.
What makes the fraud so dangerous is the sophistication of the criminals. Fraudsters frequently impersonate top executives through email, messaging apps, social media platforms, and even AI-generated voice calls. The fake messages are often so close to the real corporate messages that employees can’t see the deception.
Cybersecurity experts say the scammers start to collect publicly available information on a company’s leadership, structure, and business activities. They can look at social media profiles, company websites, press releases, and professional networking sites to see how corporate hierarchies and communication patterns are structured. Armed with all this information, they may be able to write convincing messages that sound authentic.
A common scenario is an employee getting a call from a “CEO” that a confidential acquisition, vendor payment, or regulatory problem needs to be resolved as soon as possible. The employee is advised not to tell them about it as it’s “sensitive.” Obviously, the employee thinks that the request is legitimate and is worried about not being able to do so, so he agrees to transfer money. Of course, the fraud is discovered so soon that the money has been moved through many accounts and is very difficult to recover.
SEBI’s warning is an indication of an epidemic of such attacks and the financial damage they can be causing. As the regulator has said, companies should have rigorous verification procedures in place for all high-value transactions. And employees should never just look at emails, text messages, or messaging apps to approve large financial transfers. They need multi-level authorization systems and independent verification systems.
Commercial cybersecurity professionals recommend some preventative measures businesses should take. These include callback verification for payment requests, multi-factor authentication, employee training, phishing simulations, and clear escalation procedures for unusual financial instructions. Companies should also be teaching staff about social engineering techniques that criminals use to manipulate victims.
Artificial intelligence has made the threat more complex. Now fraudsters can make highly realistic voice clones and deepfake videos that mimic senior executives. Such technologies can make fraudulent communications seem even more credible, increasing the risk of successful attacks.
Experts say that no organization can be immune, regardless of size. Big companies will be targeted for financial resources, but small and medium-sized firms will also be victims in the cybersecurity crisis because of weak cybersecurity infrastructure and fewer internal controls.
The advisory of SEBI is an important reminder that cybersecurity is not just an IT issue, but a business issue. Cybercriminals are getting better and better at their tricks and organizations need to collaborate with technology, employee knowledge, and good governance to prevent financial fraud.
The regulator has advised companies to look out and to make sure all employees know the warning signs of the “Boss Scam.” One fake message with trust and urgency can result in losses of a few billion rupees, and so the preventive measures are necessary.
Comments
Please to leave a comment on this article.