Team Nevesh | July 2026
SEBI has warned companies, financial institutions and market intermediaries to stay alert against a new form of cyber fraud that uses artificial intelligence to impersonate senior executives and trick employees into transferring money.
The warning comes after the Indian Cyber Crime Coordination Centre (I4C) reported a rise in what investigators call the “Boss Scam”, where fraudsters pose as CEOs, managing directors and other top officials through WhatsApp, email, Microsoft Teams and video calls.
The fraud has now reached India’s mutual fund industry.
SEBI said scammers have recently impersonated Kailash Kulkarni, Managing Director & CEO of HSBC Mutual Fund, Nilesh Shah, Managing Director of Kotak Mahindra AMC, and Swarup Mohanty, Vice Chairman & CEO of Mirae Asset Mutual Fund. Fake social media profiles and messaging accounts carrying their names have reportedly been used to approach investors and employees.
The regulator believes these incidents are part of a wider trend where criminals are using AI tools to make fake identities appear convincing enough to bypass routine checks.
How the fraud unfolds
The scam usually begins with what looks like an urgent message from the company’s top executive.
An employee in the finance or accounts department receives instructions to release funds immediately, often with a request not to discuss the transaction because it involves confidential or unpublished price-sensitive information.
In several cases, the person issuing those instructions isn’t the CEO at all.
Investigators say fraudsters are now using voice-cloning software, deepfake video calls and fake online groups to imitate senior executives with surprising accuracy. What once looked like an obvious phishing attempt can now sound and even look genuine.
Another version of the scam starts with a ZIP attachment.
Once opened on a Windows computer, the file installs malware that can take over an active WhatsApp Web session. From there, attackers begin sending payment instructions from the victim’s own account, making the requests appear authentic to colleagues.
SEBI also pointed to cases where attackers changed contact details on compromised devices, replacing a genuine executive’s phone number with their own. To an unsuspecting employee, the message appears to come from a familiar contact.
Verification is now the first line of defence
Rather than relying only on technology, SEBI has asked organisations to tighten internal verification procedures.
Any payment request received over WhatsApp, email or other messaging platforms should be confirmed through a direct phone call to the concerned official using a known number. The regulator has also advised companies not to approve fund transfers based solely on digital messages and to avoid opening ZIP files or executable attachments unless the sender has been independently verified.
Employees have also been urged to regularly log out of unused WhatsApp Web sessions, which reduces the risk of account hijacking.
AI is changing the nature of financial fraud
The latest warning reflects how cybercrime is evolving alongside artificial intelligence.
Instead of breaking into banking systems, fraudsters are increasingly exploiting trust inside organisations. A cloned voice, a familiar profile picture or a realistic video call can create enough confidence for someone to approve a payment that would otherwise have raised questions.
For investors, the advisory carries an equally important message. Mutual funds, asset management companies and regulators do not seek investments or request money transfers through personal WhatsApp chats or social media messages. Any communication claiming to come from a senior executive should be verified through official customer support channels before any action is taken.
SEBI has asked organisations to report suspected cyber fraud without delay through the national cybercrime helpline 1930 or the National Cyber Crime Reporting Portal, as early reporting significantly improves the chances of preventing further losses.
As AI tools become more sophisticated and easier to access, experts expect impersonation scams to become more frequent. For businesses, a simple verification call may now be one of the most effective safeguards against a costly mistake.
Disclaimer: This article is for informational purposes only and is based on publicly available information released by SEBI and other official sources. Readers should independently verify information through official channels before taking any financial or cybersecurity-related action.
