The India Cyber Crime Coordination Centre recently issued a warning about the increase of executive impersonation scams on messaging apps.

These executive impersonation scams, called "Boss Scams", occur when cyber criminals pretend to be senior company executives in order to pressure employees to transfer money. The scammers rely on urgency to convince the employee to bypass protocol and transfer money without allowing them time to think and utilize proper procedures.

Cyber criminals are now using messaging apps such as WhatsApp and Microsoft Teams to execute this scam. They pose as senior executives and reach out to employees via these platforms. The novelty of carrying these schemes out via messaging apps instead of email makes the request seem authentic, tricking employees.

Source: https://www.outlookmoney.com/news/boss-scam-alert-cyber-criminals-are-using-whatsapp-to-trick-employees-into-sending-company-funds

Commentary

Many view messaging apps as more secure than traditional email or texting.

This way of thinking is exactly what cyber criminals are counting on as they leverage the perceived legitimacy and personal nature of messaging apps to convince employees to transfer money by impersonating executives.

To help avoid the risks on messaging apps, consider the following:

· Apply the same business email compromise controls to all messaging platforms including WhatsApp, Microsoft Teams, Slack, Signal, text message, and more.

· Require independent verification for all communications regarding fund transfers.

· Never allow independent verification to occur on a number or email address provided within the messaging app that instigated the need for verification. Instead, always use a known, trusted phone number or email address.

· Prohibit fund transfers when they are initiated only via chats or text messages, no matter who is making the request.

· Publish a list of approved channels for fund transfer requests.

· Conduct training focused on fraud tactics, including urgency, authority, and secrecy, which cyber criminals often use to get employees to bypass proper protocols.