Cyber police advise companies to treat payment instructions received through messaging applications with caution. Every request involving large fund transfers or changes in beneficiary accounts should be independently verified through a phone call to a known and previously verified number.A Pune-based sugar trader lost a staggering Rs three crore in an invasive form of a whale-phishing attack within an hour on Monday. Police said that the cyber fraudsters hacked his accountant’s phone, made it appear as though messages were being sent by the trader himself and then used the ruse to get three money transfers made from the company’s bank account.According to an FIR registered at the Pune City Cyber Police Station on Monday, the fraud took place in less than an hour on the morning of August 31. The complainant, a 42-year-old sugar trader, runs the business through a family-owned trading firm based in Market Yard. The complainant told police that his accountant, who has been working with the firm for around nine years, received a WhatsApp message from an unknown number saved under the trader’s name at around 10.47 am. The message sought details of the firm’s internet banking balance. The accountant responded that the account had a balance of around Rs 8.50 crore.Soon after, the accountant received details of a Bank of Baroda account along with a WhatsApp message asking him to “transfer 3 Cr”. Believing the messages were from the trader, the accountant used the company’s accounting software to make three transfers of Rs one crore each. Probe has revealed these transfers were made to a mule accounts Rewa districts of Madhya Pradesh.The fraud came to light when the trader was contacted by the accountant for a GST number relating to the transaction. The trader told him that he had neither initiated any such transaction nor instructed anyone to transfer money. On checking the accountant’s computer, the company found that Rs three crore had been transferred from its account to the beneficiary account in three transactions.The trader also checked the accountant’s mobile phone and found that his own name had been used to save the WhatsApp number from which the instructions were sent. However, the WhatsApp number and the conversation subsequently disappeared from the device.During further questioning, the accountant told the trader that he had received a suspicious file named “Transaction_Details_31/08/2026 img” two days earlier from another unknown number. A second accountant working with the firm had also reportedly received the same file. “Probe suggests that this malware was used to compromise the accountants phone, hack into the contacts and use the compromised device for the fraud,” said an officer. Police have registered a case under provisions of the Information Technology Act and the Bharatiya Nyaya Sanhita relating to cheating and criminal conspiracy. Police Inspector Sharad Shelke has been assigned the investigation.An officer from the Cyber police station said, “Whale phishing, also known as a boss scam or CEO scam, is a highly targeted form of phishing in which fraudsters specifically target senior executives, business owners or individuals with access to large sums of money. Unlike conventional phishing, it involves studying the victim’s communication patterns and relationships to make fraudulent messages appear genuine. In a typical whale-phishing attempt, fraudsters may contact the victim from an unknown number using a CEO’s name and photograph. In this more invasive form, however, the attackers gain access to an existing device or account, use the victim’s chats and continue conversations within the same thread, mimicking earlier communication patterns and context.”Story continues below this adCyber police advise companies to treat payment instructions received through messaging applications with caution. Every request involving large fund transfers or changes in beneficiary accounts should be independently verified through a phone call to a known and previously verified number. Organisations should regularly review active WhatsApp Web sessions, enable multi-factor authentication, restrict installation of unverified software and conduct periodic cyber-security audits. Finance teams should also adopt dual-approval mechanisms for high-value transactions and undergo regular awareness training to recognise signs of phishing and account compromise, officials said. Sushant Kulkarni is a Special Correspondent with The Indian Express in Pune with 12+ years of experience covering issues related to Crime, Defence, Internal Security and Courts. He has been associated with the Indian Express since July 2010. Sushant has extensively reported on law and order issues of Pune and surrounding area, Cyber crime, narcotics trade and terrorism. His coverage in the Defence beat includes operational aspects of the three services, the defence research and development and issues related to key defence establishments. He has covered several sensitive cases in the courts at Pune. Sushant is an avid photographer, plays harmonica and loves cooking. ... Read MoreClick here to join Express Pune WhatsApp channel and get a curated list of our storiesTags:pune