Sebi warns Indian listed firms over rising CEO fraud scams
India's markets regulator has warned listed companies about a surge in AI-driven CEO impersonation scams that target finance executives to execute fraudulent fund transfers.
The Securities and Exchange Board of India (Sebi) has issued a formal advisory to all listed companies and regulated entities regarding a sharp increase in "Boss Scam" cyber fraud. The warning follows an alert from the Indian Cyber Crime Coordination Centre (I4C), which identified a growing trend of cybercriminals specifically targeting high-ranking officials and finance executives.
The fraud centres on impersonating chief executives or managing directors to pressure subordinates into authorising urgent fund transfers to specified accounts. To bypass traditional verification, perpetrators are increasingly deploying artificial intelligence tools, including voice cloning and deepfake video calls. These sophisticated techniques make the impersonation highly convincing during live communications over platforms like Microsoft Teams, WhatsApp, and standard corporate email networks.
Sebi noted that cybercriminals are also using malicious software to hijack corporate communication channels. In one method, targets receive a compressed ZIP file containing Windows malware that, once opened, hijacks active WhatsApp Web sessions. This grants attackers direct access to the victim's account to issue payment instructions to finance personnel, or allows them to alter device contact lists to replace legitimate executive numbers with their own.
For investors and corporate boards, the alert underscores a material operational risk that can directly impact bottom lines. Fraudulent transfers authorised under the guise of executive urgency can result in immediate, unrecoverable financial losses. Furthermore, the weaponisation of AI for deepfakes and voice cloning lowers the barrier for cybercriminals, rendering conventional verification protocols inadequate for listed entities handling large capital flows.
Sebi has urged companies to immediately audit their internal financial controls, particularly around emergency payment approvals. The regulator specifically instructed entities to log out of inactive WhatsApp Web sessions to mitigate session hijacking. Any cyber fraud incidents must be reported immediately by calling the national cybercrime helpline 1930 or through the Cyber Crime portal.
