CEO Fraud on WhatsApp: When Someone Impersonates the Head of Your Office

“CEO fraud” in an Indian office usually arrives as a WhatsApp message from an unknown number showing the photograph of the Vice-Chancellor, Director or Managing Director, asking a junior officer to buy gift cards or make an urgent transfer. It is cheating by personation under s.66D of the IT Act (up to 3 years and fine up to ₹1 lakh) and s.319 of the Bharatiya Nyaya Sanhita (up to 5 years, or fine, or both). The single best defence is a standing written instruction from the head of the institution that no financial request received only on a messaging app will be acted upon. If money has gone, call 1930 at once.

How the fraud works

A section officer in a state university in Jaipur receives a message: “I am in a meeting with Ministry officials and cannot take calls. Please arrange ten gift cards of ₹10,000 each and send me the codes. Urgent.” The display picture is the Vice-Chancellor’s official photograph, lifted from the university website. The number is unfamiliar, sometimes foreign. The writer says he will reimburse later.

The method depends on four things:

• Authority. The request seems to come from the top.
• Urgency. There is no time to check.
• A reason not to call back. “In a meeting”, “on a flight”, “network is poor”.
• Hesitation. A junior officer does not want to look disobedient by questioning a senior.

Variations ask for a transfer to a “consultant”, staff bank details or a signed letterhead. Gift cards are favoured because codes are redeemed in minutes.

A real example: BHU, June 2022

In June 2022, faculty and staff of Banaras Hindu University received WhatsApp messages from an unknown foreign number showing the Vice-Chancellor’s name and photograph, asking them to buy Amazon gift cards and send the codes. On 3 June 2022 the university issued a public warning on its official handle telling staff not to entertain any such requests and to inform the authorities. The same method has since been reported in the names of heads of several other universities and colleges. The lesson is that a warning from the top, issued immediately, protects every desk. A standing instruction issued before the first message is better still.

The law that applies

• IT Act s.66D: cheating by personation by means of a communication device or computer resource. Imprisonment up to 3 years and fine up to ₹1 lakh. Every ingredient is present: deception, inducement, personation and a device.
• BNS s.319: cheating by personation, punishable under s.319(2) with up to 5 years, or fine, or both. BNS s.318 (cheating) also applies where property is delivered.
• IT Act s.66C (identity theft) may apply if a real account or password of the officer was used.
• The officer who was deceived is a victim, not an offender.

Why a standing written instruction protects staff

The junior officer’s real problem is fear of offending the boss. Once the head has said in writing that verification is expected, calling back is obeying, not questioning. It is also a record that the institution took reasonable steps. A model text:

[Institution name]
Office Order No. [__] dated [date]
Subject: Requests for money, gift cards or payments received on messaging apps

1. No officer or employee shall act on any request for payment, purchase of gift cards, transfer of funds, or sharing of financial or personal information of staff or students, received only through WhatsApp, Telegram, SMS or any other messaging app, even if it appears to come from the [Head of Institution] or any senior officer.
2. Every such request shall be verified by calling the officer concerned on the official number listed in the [Institution] directory, or in person. Verification is expected and will not be treated as discourtesy.
3. The [Head of Institution] will never ask any employee to buy gift cards.
4. Any suspicious message shall be reported to the Nodal Officer (Cyber), [Name and Designation], at [official contact]. Where money is lost, the employee shall also call 1930 and file on cybercrime.gov.in at once.
5. This order shall be displayed in every section and circulated to all new staff on joining.

[Signature]
[Head of Institution]

What to do if money has already been sent

1. Call 1930 immediately and file on cybercrime.gov.in. Speed is what gets money frozen in transit. Do not wait for an FIR first.
2. Inform your bank in writing with the transaction details, and ask it to alert the beneficiary bank.
3. For gift cards, write to the issuer at once with the card numbers and purchase receipts. Unredeemed balances can sometimes be blocked.
4. Preserve evidence. Screenshots of the chat with the number visible, the profile picture, the payment receipts. Delete nothing.
5. Lodge an FIR under BNSS s.173, describing the facts fully. The police will choose the sections.
6. Warn all staff the same day, and the public if needed.
7. Record each step and its time in a note to the head of office.

A note on bank refunds: RBI’s current customer liability rules are written for unauthorised transactions. A payment the institution’s own officer authorised, even under deception, is generally outside them. That is why prevention matters more than recovery.

Frequently asked questions

Will the officer who paid be held personally responsible?

The officer is a victim of crime. Departmental consequences depend on service rules and facts; acting against a clear standing instruction weakens the officer’s position.

Should we also report to CERT-In?

Phishing and spoofing are in CERT-In’s list of reportable incidents. Where an institutional system or account is involved, report within 6 hours.

Does this apply to email as well?

Yes. Look-alike email addresses are the same fraud in another channel, and the same verification rule should cover them.

Quick quiz

For heads of office, accounts and administrative staff: Cyber Crime Law for Offices and Institutions, ₹599. It is a certificate of completion, not a professional qualification.

Sources

• Information Technology Act, 2000: ss.66C, 66D, 85
• Bharatiya Nyaya Sanhita, 2023: ss.318, 319
• Bharatiya Nagarik Suraksha Sanhita, 2023: s.173
• CERT-In Directions under s.70B(6) of the IT Act, dated 28 April 2022
• Banaras Hindu University, public warning on its official handle, 3 June 2022

This page is for education and general information, not legal advice for a specific case. Law as on 29 October 2026.