SEBI Warns: Rising ‘Boss Scam’ Cyber Fraud

SEBI WARNS AGAINST THE RISING ‘BOSS SCAM’ CYBER FRAUD

Why in the News?

• Regulatory Advisory: The Securities and Exchange Board of India (SEBI) has issued an advisory to regulated entities and listed companies warning them about the rising incidence of the ‘Boss Scam’, a sophisticated cyber fraud.
• AI-Driven Threat: Acting on inputs from the Indian Cyber Crime Coordination Centre (I4C), SEBI has urged organisations to strengthen verification mechanisms against frauds using artificial intelligence (AI), deepfakes, and malware.

WHAT IS THE ‘BOSS SCAM’?

• Impersonation Fraud: The Boss Scam is a form of Business Email Compromise (BEC) in which cybercriminals impersonate a CEO, Managing Director, or other senior executive to trick employees into making unauthorised financial transfers.
• Deepfake Technology: Fraudsters use AI-generated voice cloning, manipulated video calls, fake messaging accounts, and spoofed emails to convincingly imitate company leadership and create a sense of urgency.
• Malware-Based Attacks: Criminals also distribute malicious ZIP files containing executable (.exe) and Dynamic Link Library (.dll) files that install malware, enabling unauthorised access to corporate systems.
• Targeted Employees: Finance, accounts, treasury, and payment-authorisation officials are the primary targets, as they have access to company funds and financial systems.
• SEBI’s Advisory: Organisations have been advised to strengthen multi-level verification procedures, employee awareness, cybersecurity practices, and authentication mechanisms before processing high-value transactions.

SIGNIFICANCE OF THE ISSUE

• Emerging Cyber Threat: The increasing use of AI and deepfake technologies has made cyber frauds more convincing, difficult to detect, and capable of bypassing traditional security measures, reflecting broader patterns of strategic competition in the digital domain.
• Financial Stability: Successful attacks can result in substantial financial losses, reputational damage, data breaches, and disruption of business operations, undermining economic interdependence and trust in digital financial systems.
• Corporate Governance: Robust internal controls, segregation of duties, and verification protocols are essential components of good corporate governance and risk management.
• Cyber Awareness: Regular employee training and cyber hygiene practices are critical to reducing human errors, which remain one of the weakest links in organisational cybersecurity.
• Need for Coordination: Effective prevention requires multilateral engagement and regional security cooperation among SEBI, I4C, CERT-In, financial institutions, and corporate entities to strengthen India’s cyber resilience and support a cooperative security framework aligned with the indo-pacific strategy.