Boss scam
बॉस घोटाला
INDIA — By BharatSecure Threat Intelligence Team ·
Category: Job
Verdict Summary
Boss scam is a confirmed scam. Do not engage — block the sender and report to 1930 (National Cyber Crime Helpline) immediately.
Risk score: 10/10 · Severity: Critical · Verdict: Dangerous
Scam Intelligence: Boss scam
Proprietary signals from BharatSecure's scam-tracking database.
| Last reported | Aug 12, 2026 |
| First documented | Aug 12, 2026 |
How Boss scam Works
- Attackers send malicious .zip files through WhatsApp, SMS, or email disguised as statements or regulatory documents.
- When opened on a Windows device, malware installs and hijacks the victim’s WhatsApp Web session or compromises the device.
- Fraudsters use the hijacked account or a spoofed executive identity to instruct staff to make urgent transfers to mule accounts.
How This Scam Works — Detailed Explanation
The Boss scam preys on employees of an organization, often using trusted platforms like WhatsApp and email to interact with victims. Scammers find potential targets by researching company structures online or leveraging social engineering tactics to disguise their communications as legitimate. They may impersonate high-ranking officials like the CEO or other executives, reaching out to employees for mundane reasons initially, then escalating to critical requests. They might even use employees’ publicly available information to build trust, making it crucial for everyone in a workplace to be cautious about what is shared online.
Once they have identified a target, scammers deploy various psychological tactics to manipulate their victims. They often induce a sense of urgency, presenting scenarios where immediate action is claimed to be essential, such as financial transactions that must be done to secure business deals. They are skilled at creating fake .zip attachments named as vital documents, which can include anything from internal statements to compliance notices. By crafting messages that seem official and time-sensitive, they can catch their targets off-guard. This fosters a reluctance to question the authenticity and pushes employees to act quickly without proper verification.
After an unsuspecting employee opens the malicious .zip file on a Windows device, the contained malware activates, compromising the device security and potentially hijacking the victim's WhatsApp Web session. In this way, the scammer gains direct access to the victim's communication channels without their knowledge. For example, a marketing associate in a Bengaluru-based startup opens a file titled 'Important Financial Update.zip' and unwittingly compromises their WhatsApp. The attacker then impersonates the CEO through this account, sending messages instructing the associate to transfer funds urgently to a specified account, often a mule account used to cash out before the transaction can be traced back.
The repercussions of such scams can be severe for both individuals and companies in India. According to reports, cases like these contribute to an alarming rise in financial fraud, with victims losing substantial amounts — in many cases, running into crores. The Indian government recognizes the urgency of these threats. The Ministry of Home Affairs (MHA), and enforcement agencies like CERT-In continuously issue advisories on how to tackle such scams. Victims are advised to report incidents but underreporting occurs due to shame or fear of accountability. The damaging impact of these scams highlights the importance of awareness and vigilance among employees to protect both their finances and their organization’s integrity.
To accurately differentiate between genuine communication and scams, employees should watch out for certain red flags. Legitimate requests will rarely come with unexpected .zip file attachments, even from familiar contacts. Always confirm any urgent transaction requests by reaching out to the sender through a known and secure channel — do not reply to the suspect message directly. Check for inconsistencies in language and tone in written communications and ensure any financial requests are verified through established organizational protocols before action is taken. Maintaining open communication about verification processes within the workplace can significantly help in combating the threat posed by the Boss scam.
Who Does Boss scam Target?
Professionals, business owners, finance teams, accounts staff, and senior executives in India
Red Flags — How to Identify Boss scam
- Unexpected .zip attachment from an unknown or even familiar account
- Files named like official statements or regulator communications
- Urgent transfer requests from a compromised 'CEO' or boss account
What To Do If You Encounter Boss scam
- Report the incident to the cybercrime helpline by calling 1930 or visiting cybercrime.gov.in.
- Immediately change your WhatsApp password and enable two-step verification for added security.
- Alert your company's IT department or security team about the suspicious communication.
- Forward the malicious message and files to your superior for awareness and further action.
- Contact your bank's helpline (SBI: 1800-11-1109, HDFC: 1800-202-6161) to inform them of potential fraudulent activity.
- Educate your colleagues about this scam to foster a secure workplace culture.
How to Report Boss scam in India
- Call 1930 — National Cyber Crime Helpline (24x7)
- File a complaint at cybercrime.gov.in
- Contact your bank immediately if money was lost
- Call RBI helpline: 14440 for banking fraud
Frequently Asked Questions
- What to do if I shared my OTP in a Job scam?
- Immediately change your passwords for bank accounts and report the incident to your bank and cybercrime helpline 1930.
- How can I identify this specific Boss scam?
- Look for unexpected urgent requests, especially involving .zip attachments and instructions to transfer money that appear to come from executives.
- How do I report this type of scam in India?
- You can report incidents by calling 1930 or visiting cybercrime.gov.in, and additionally notify your bank.
- What are the recovery steps after falling victim to this scam?
- Immediately inform your bank about the transaction, change account passwords, and report the incident to the cybercrime helpline.
How This Scam Works — BharatSecure AI
Spreading fastA plain-language breakdown based on 212 real reported scams of this type.
| How they reach you | Fraudulent job offers are documented as first reaching victims primarily through WhatsApp, Telegram, social media ads, and job portals (Naukri, LinkedIn, WorkIndia), promising high-paying overseas or |
| How they gain your trust | Trust is reportedly established via fake interviews, forged offer letters using well-known brand logos, WhatsApp groups of fake 'selected candidates', and small initial reimbursements or task payments |
| How they take your money | Observed rails include UPI/GPay transfers, bank transfers to mule accounts, cryptocurrency deposits and wallet reshipping, with upfront fees documente |
| Who they target | Most commonly targeted are young, often English-speaking job seekers, students, and professionals from urban Tier-2/3 cities and rural backgrounds across states like Andhra Pradesh, Telangana, West Be |
- scarcity/urgency (job cancellation threats, deadlines)
- authority bias (impersonation of recognised brands and officials)
- reciprocity/sunk-cost (small initial payouts then progressively larger 'fee' demands)
- Upfront payment demanded for processing, visa, training, uniforms, laptops or Mediclaim
- Job offers and interviews conducted via WhatsApp/Telegram or personal Gmail rather than official domains
- Unrealistically high salaries for minimal work or overseas roles obtained without formal process
- Pressure and urgency with threats of losing the offer if payment is delayed
- Requests to travel abroad on tourist visas, surrender passports, or make crypto/test transactions
Related Scams in India
Verify Any Suspicious Message
Check any suspicious message, link, or call for free at bharatsecure.app. BharatSecure uses AI to detect scams in real-time and protect Indian users.