Prime Today News Desk: An urgent message that appears to come from a chief executive or senior manager can be difficult to ignore. That pressure is exactly what fraudsters exploit in a boss scam, a form of impersonation fraud in which an employee is instructed to transfer money, buy gift cards or share sensitive business information.
HDFC Bank has advised customers to remain alert to this method. The scam can arrive through email, a messaging app or even a phone call. Criminals may copy a senior executive’s name, photograph, writing style or email format so that the request looks credible at first glance.
Urgency and secrecy are common warning signs
A typical message claims that a confidential payment must be completed immediately and that the executive cannot speak on the phone. The fraudster may ask the employee to bypass the normal approval process or keep the transaction secret. A sudden change in bank details, an unfamiliar phone number or a slightly altered email domain can also indicate an attempted fraud.
Artificial-intelligence tools have made impersonation more convincing. A message can be written in a familiar tone, and audio or video may be manipulated to imitate a real person. For that reason, recognising a face or voice is no longer enough when a request involves money or confidential data.
Verify through an independent channel
Employees should pause the transaction and contact the executive or another authorised manager using a phone number already stored in the company’s records. They should not rely on contact details supplied in the suspicious message. Organisations can reduce risk by requiring two-person approval for payments and by training staff to report unusual requests quickly.
If money has already been sent, the bank and the organisation’s security team should be informed immediately. A prompt report may improve the chance of stopping or tracing the payment. The central lesson is simple: legitimate authority does not remove the need for verification, especially when a request is urgent, secret or outside normal procedure.
Controls businesses can introduce immediately
Companies can maintain an approved-vendor register, require callback verification for changed bank details and block large payments that have only one authoriser. Staff should have a simple reporting channel that does not punish someone for raising a false alarm.
Security teams should also monitor lookalike email domains and rehearse an incident-response plan. The faster a suspicious payment is escalated, the better the chance that banks and law-enforcement agencies can intervene.
Source: Business Standard. This is an independently written report based on the cited reporting.
