A Bavdhan-based automobile dealership allegedly lost ₹2.2 crore in a sophisticated phishing attack after cybercriminals impersonated the company's directors and instructed an account executive to transfer funds to multiple bank accounts. The fraud, which took place between August 13 and 14, came to light when the company was closing its accounts on August 14.
A Case of "CEO Fraud"
The 54-year-old dealer subsequently approached the Pimpri Chinchwad cyber police and lodged a complaint against the unidentified fraudsters. The incident is being investigated as a form of business email or executive impersonation fraud, commonly referred to as "whaling" or "CEO fraud," in which criminals pose as senior company officials to manipulate employees into authorising financial transactions without proper verification.
How the Fraudsters Hijacked the Director's Identity
According to the complaint, the fraudsters first gained control of the dealer's mobile messaging application account. They allegedly blocked his existing mobile number and created a new profile using a different number, carrying the dealer's own photograph as the display picture — making it appear to the account executive that messages were genuinely coming from the company's director.
The fraudsters then began communicating with the account executive through the messaging platform, reportedly instructing her not to call the dealer or send messages to his original number. By creating the impression that senior management was communicating through this new number, the suspects allegedly prevented the employee from independently verifying whether the instructions were actually legitimate.
Three Accounts, ₹2.2 Crore Transferred
The account executive subsequently received instructions to transfer money to bank accounts provided by the fraudsters. According to the complaint, three different bank account numbers were shared with her, and acting on these instructions, she transferred a total of ₹2.20 crore between August 13 and 14.
Investigators said the account executive did not independently verify the bank details before making the transfers, simply because she believed the instructions had come from the company's director. This kind of situation is exactly why sound business advisory guidance matters so much for companies — establishing clear, verified financial approval protocols for large transfers can prevent employees from being manipulated purely through familiarity and apparent authority, regardless of how convincing the messaging or urgency might seem.
How the Fraud Was Discovered
The fraud came to light on the evening of August 14, when the company's accounts were being closed for the day. The dealer immediately realised the transactions hadn't been authorised by him and contacted the cyber police, triggering an urgent effort to trace the transferred funds and prevent any further movement of the money.
Cyber police managed to freeze ₹87 lakh of the allegedly defrauded amount. However, investigators found that a substantial portion of the remaining money had already been transferred from the initial recipient accounts to several other bank accounts, and police are now working to trace these subsequent transactions and identify the individuals operating those accounts.
What Investigators Are Digging Into
The investigation is also focused on determining exactly how the fraudsters gained access to the dealer's messaging account in the first place, and how they obtained information about the company's internal financial processes well enough to convincingly impersonate the director. Investigators are expected to examine digital devices, transaction records, bank accounts, and communication trails connected to the case.
This incident really highlights how impersonation-based cyber fraud can exploit routine business procedures rather than technical vulnerabilities alone. In CEO fraud cases like this one, criminals typically rely on urgency, apparent authority, and familiarity to persuade employees into bypassing normal verification procedures — even when those procedures exist precisely to prevent this kind of manipulation.
Advice for Businesses
Cybersecurity experts advise businesses to independently verify payment instructions, particularly when they involve large or unusual transfers. Employees should confirm any changes in bank account details through an established, separate communication channel, rather than relying solely on messaging applications or caller identification, both of which can be spoofed or manipulated fairly easily by determined fraudsters.
Police continue their investigation to trace the remaining funds and identify the fraudsters involved in this ₹2.2 crore transaction trail.
FAQs
Q1. How did the fraudsters impersonate the company's director?
The fraudsters allegedly hijacked and blocked the director's mobile messaging account, then created a new profile using his photograph, making it appear to the account executive that messages were genuinely from him.
Q2. How much money was lost, and how much has been recovered?
A total of ₹2.20 crore was transferred by the account executive, of which cyber police have managed to freeze ₹87 lakh so far.
Q3. What can businesses do to prevent similar CEO fraud incidents?
Experts advise independently verifying payment instructions through an established, separate communication channel, especially for large or unusual transfers, rather than relying solely on messaging apps or caller ID.