Delhi Police Arrests Key Suspect in Rs 7.8 Crore ‘Boss Scam’ Targeting Ex-PM’s Son

The Delhi Police's Intelligence Fusion and Strategic Operations (IFSO) unit has arrested a 40-year-old man from Amritsar in connection with a Rs 7.8 crore fraud that targeted former Member of Parliament Naresh Gujral, son of former Prime Minister I K Gujral. The arrest marks the first breakthrough in a case that highlights a growing cyber fraud technique known as the 'Boss Scam' or CEO impersonation fraud.

According to police officials, the scam operates through a two-tier structure. The first tier involves deceiving the victim and their company employees, while the second tier routes and launders stolen funds through multiple mule accounts. The arrested individual is believed to be part of the second tier, which used at least 35 bank accounts across the country. Investigators found that the stolen money was initially distributed among four accounts: two in Maharashtra, one in Telangana, and one in Andhra Pradesh.

The modus operandi began with a WhatsApp message containing a link to a ZIP file, which was sent to a director of Gujral's company. The message claimed the company account would be closed unless verified urgently. The director forwarded the message to an accountant, who clicked on the link and unknowingly compromised his device. This allowed the fraudsters to gain control of the accountant's WhatsApp account, alter Gujral's contact details, and impersonate him. Posing as Gujral, they instructed the accountant to transfer Rs 7.8 crore through four Real-Time Gross Settlement (RTGS) transactions, a system for high-value urgent payments.

Police sources said the scammers are increasingly targeting high-ranking officials and corporate executives by sending malicious ZIP archives through email or WhatsApp, often posing as regulatory bodies like the Reserve Bank of India (RBI). The messages create a false sense of urgency by providing a short compliance window. Once the ZIP file is executed, malware infects the device, enabling scammers to monitor communications and orchestrate fraudulent transfers.

Officers noted that ZIP files have become a common tool after APK-based malware links. The compressed archive typically contains a malicious executable (.exe) file and a dynamic link library (.dll) file. Similar cases have been reported across the country, with over 100 complaints in various cities. The scammers primarily target company owners, CEOs, and senior executives. Investigations have also found indications that many 'Boss Scam' operations are run from Cambodia and other Southeast Asian countries. The Indian Cyber Crime Coordination Centre (I4C) has raised concerns about this growing threat.