Police said the case is significant as the fraud was carried out through Microsoft Teams, a workplace communication platform used by companies for internal conversations and instructions. (Image generated using AI)A PUNE-BASED engineering company lost Rs 30 lakh after a cyber fraudster allegedly impersonated one of its directors on Microsoft Teams and sent instructions to transfer the money to a bank account, in a whale phishing or “boss scam” attack.According to an FIR registered with Bhosari MIDC police station, the fraudster used a Microsoft Teams profile carrying the name and appearance of the company’s director and managed to enter the company’s Teams group. The impersonator then sent a message directing an employee to transfer Rs 30 lakh to a specified bank account.The incident took place at the company’s premises in Bhosari’s Balajinagar. After the transfer was made, the company realised the instruction had not come from its director and approached the police. The police have launched a probe to identify the person behind the impersonation and trace the money.Also Read | How a man lost Rs 3.96 lakh buying desert rose seeds onlinePolice said the case is significant as the fraud was carried out through Microsoft Teams, a workplace communication platform used by companies for internal conversations and instructions. “Unlike conventional Whale phishing communication on WhatsApp or email, a fraudulent message appearing in a familiar corporate communication environment can make employees less suspicious, particularly when the account carries the name and photograph of a senior executive,” said an officer.What are whale phishing scams or boss scams?Whale phishing, also known as CEO fraud or “boss scam”, is a targeted cyber fraud in which criminals impersonate senior executives and approach employees who can authorise financial transactions. Unlike mass phishing campaigns, these attacks are carefully planned and directed at specific individuals within an organisation.In an earlier Pune case, the CFO of an Italian engineering company received a Microsoft Teams message from a profile carrying the name and display picture of the firm’s Italy-based CEO. The fraudster claimed that the CEO was busy with a government project and instructed her to transfer Rs 56 lakh. The following day, the impersonator sought another Rs 1.5 crore. The CFO became suspicious and independently contacted the CEO, discovering that no such instructions had been issued. The verification prevented the potential loss from rising beyond Rs 56 lakh.Pune has witnessed several such attacks in recent years. The Securities and Exchange Board of India (SEBI), following an alert from the Indian Cyber Crime Coordination Centre (I4C), has cautioned companies about “Boss Scam” or CEO/MD impersonation fraud. The warning said fraudsters were using email, WhatsApp, Microsoft Teams and social media platforms to impersonate senior executives and direct finance personnel to transfer money.Story continues below this adAlso Read | How Gujarat police used a live ‘digital arrest’ to trap cyber fraudster in AssamHow to prevent boss scams on Teams“Companies should not treat a message on Teams as sufficient proof of the sender’s identity, particularly when it involves money, urgency or confidentiality. Employees receiving unusual payment instructions from senior executives should independently verify them through a known phone number or another established communication channel before acting.” Said a Cyber investigator from Pimpri Chinchwad police.“Organisations should also restrict external access to Teams where possible, carefully review guest and external users, enable multi-factor authentication and maintain a mandatory second-level approval for large or unusual financial transactions.” the officer added. “The most important safeguard is to verify the instruction, not merely the identity displayed on the screen. A familiar name and photograph on Teams can be copied or impersonated, but a direct verification through a trusted channel can expose the fraud before money is transferred.” the officer said.Sushant Kulkarni is a Special Correspondent with The Indian Express in Pune with 12+ years of experience covering issues related to Crime, Defence, Internal Security and Courts. He has been associated with the Indian Express since July 2010. Sushant has extensively reported on law and order issues of Pune and surrounding area, Cyber crime, narcotics trade and terrorism. His coverage in the Defence beat includes operational aspects of the three services, the defence research and development and issues related to key defence establishments. He has covered several sensitive cases in the courts at Pune. Sushant is an avid photographer, plays harmonica and loves cooking. ... Read MoreClick here to join Express Pune WhatsApp channel and get a curated list of our storiesTags:Cyber fraud