Ahmedabad: Cheating of Rs 1.5 crore through 'Boss Scam', cyber gang exposed

One message, one zip file, and then within a few hours Rs 1.5 crore was transferred from the company's account.

Ahmedabad Police claimed to have got to the bottom of this crime and said that cyber criminals, using the identity of the company boss, got the employees to transfer money on a large scale.

In this type of scam, a message is sent on WhatsApp to the company's accountant or finance department employee using the name and profile photo of the company boss.

The message instructs to immediately transfer the amount to a specified account. This type of cyber fraud is known as 'Boss Scam'.

Even if the message doesn't come from the boss's number, it appears on the employee's phone as the boss's name. Due to this, the employee faces the risk of transferring money without verifying the message.

The investigation by Ahmedabad Cyber ​​Crime Police has revealed that an organized gang using fake SIM cards, OTPs, WhatsApp accounts and malware is behind such frauds.

The police investigated 251 complaints registered in 26 states of the country, which included information related to about 4,500 SIM cards.

These included three 'Boss Scam' complaints.

Police have said that they have received preliminary information that apart from India, the wires of this network are connected to China, Pakistan and Hong Kong. Investigation is going on in this regard.

According to the complaint lodged by Praveen Nagjibhai Bavaliya with Ahmedabad Cyber ​​Crime Police, on June 23, 2026, he received a WhatsApp message from an unknown mobile number.

The sender of the message described himself as associated with the 'Risk Control' department of the Reserve Bank of India (RBI).

The message stated that 'abnormal transaction activities' have occurred in his company's bank account and the account may be banned or suspended. A zip file was also sent with this message.

Speaking to BBC Gujarati, Praveenbhai said, "I was continuously receiving such messages for the last six months. Initially I did not pay attention to it, but since such links were coming continuously, I thought that perhaps these could be messages from RBI."

"So I sent a link to my real estate company's accountant and asked him to gather more information to make sure the account wasn't frozen."

According to him, "The accountant opened the link on his desktop and downloaded the file. After the file was downloaded, the hacker started viewing my WhatsApp contacts and WhatsApp messages from my desktop."

This incident happened with Praveenbhai when he had gone to Udaipur to attend a wedding.

According to him, the hacker was also aware of his situation. The next morning, the hacker sent a message in his name to his accountant and asked him to immediately transfer Rs 1.5 crore to a garment company in Kolkata.

The accountant transferred Rs 1.5 crore through RTGS.

After coming to know about this transaction, Praveenbhai lodged a complaint with the Cyber ​​Crime Department.

According to the police, a complaint was lodged on the 1930 helpline and an amount of Rs 1 crore 13 lakh 53 thousand 700 involved in the fraud has been recovered. Whereas approximately Rs 25 lakh has been sent abroad.

Police have arrested Iram Ali Piyada and Inzamul Mollah from West Bengal for their involvement in this scam. According to the police, investigation into the case is ongoing.

BBC tried to know the side of both the accused by talking to their lawyers or family members, but could not contact them till the time of writing the news. We will update here once we know their side.

BBC spoke to DSP Laveena Sinha of Ahmedabad Cyber ​​Crime Branch to find out how this scam was carried out.

He says that cyber criminals first pose as officials of RBI or any government agency and send a zip file to the CEO, director or employee of the company through WhatsApp or email.

"This zip file contains malicious software files like .exe or .dll. If such a file is run through WhatsApp Web on a company computer or laptop, the criminal can take control of the WhatsApp Web session."

"Then, using the identity of the company's CEO or director and adding a profile photo, they save their mobile number in the boss's name."

"After saving the number, a message is sent to the company's accounting or finance department employee to immediately transfer the money. Dummy SIM card and OTP also play an important role in this process."

According to the police, fake SIMs were made by activating mobile numbers from SIM cards found in the customers' names without their knowledge.

These SIMs were used in various phones and the information about the numbers was given to cyber criminals.

When the WhatsApp account was activated from this number, the required OTP was found on a fake SIM, which was later given to cyber criminals.

This helped criminals take control of WhatsApp.

During the investigation by Ahmedabad Police, two people have been arrested in this case, one of them was in contact with people involved in cyber fraud.

This person was helping them to take control of mobile number, fake SIM card and WhatsApp.

The second accused was working as a sales representative for telecom companies like Airtel, Jio, Vi and BSNL.

Police allege that this person used to obtain SIM cards in the name of customers using their biometric fingerprints and applications of telecommunication companies and activated the mobile number in another SIM without their knowledge.

In the world of cyber crime, now every criminal does not need to create the entire technical infrastructure himself.

Someone gives a fake SIM, someone provides OTP, someone creates a WhatsApp account and someone else talks to the victim and transfers the money.

A press release from Ahmedabad Police described such ready-made digital services, groups and resources as an example of 'Cybercrime-as-a-Service' or CaaS.

That is, the digital tools and services required to commit cyber crimes can also be easily available.

Based on information from around 4,500 SIM cards recovered during the investigation of this case, Ahmedabad Cyber ​​Crime Police investigated 251 NRCP complaints lodged in 26 states.

These complaints included 194 online financial frauds, three boss scams and 29 online and social media related crimes.

Additionally, complaints related to other types of cyber crimes, hacking, pornographic content and child sexual abuse were also included in this data.

Police have said that during the investigation, more than 10,000 such devices were recovered which contained malware.

Seven mobile phones and an Airtel router have also been seized from the accused.

The investigation is ongoing to identify other accused and key operators of the network on the basis of WhatsApp chats, groups, mobile numbers and other digital evidence present in the seized devices.

According to technical and network analysis by Ahmedabad Cyber ​​Crime Branch and I4C, the malware used in this case is suspected to be developed by cyber criminals linked to China.

Ahmedabad Police has advised to take some precautions to avoid this type of cyber fraud.

Do not download or open ZIP, .exe, .dll or .apk files received from unknown mobile numbers or emails.

In this regard, Sinha says, "If you receive a message to transfer money on WhatsApp or email, do not transfer money without independently confirming it."

"If asked by the boss or CEO to make an immediate payment, confirm by calling them, making a video call, or contacting them in person on their known or alternate number."

Time is very important in this kind of fraud. Ahmedabad Police has said to immediately contact cyber helpline 1930 or lodge a complaint on cybercrime.gov.in.

In Praveenbhai's case too, a complaint was filed soon after the fraud was detected and police action resulted in a large amount of money being frozen or recovered.