Goa Police have issued a warning about a cybercrime method known as the “boss scam”, in which fraudsters allegedly impersonate senior executives to trick employees into opening malicious files or carrying out unauthorised financial transactions. The warning follows a reported ₹2 crore loss suffered by a businessman from Mapusa and three additional complaints involving similar suspected fraud.
According to the supplied report, Goa Police’s cybercrime cell is investigating the emerging threat, in which criminals exploit employees’ trust in management and use seemingly routine workplace instructions to gain access to business systems.
Police have urged employees and business owners to verify unusual requests independently, strengthen payment approval procedures and report suspected cyber incidents without delay.
How the ‘Boss Scam’ Works
The alleged scam relies on impersonation and the authority associated with senior positions in a company. According to Police Inspector Deepak Pednekar, fraudsters may pose as a business owner, senior officer or management representative and instruct an employee to open a ZIP file on an official computer.
The communication may appear genuine and create urgency, encouraging the recipient to follow instructions without checking whether the request is authentic.
Police warned that a malicious attachment could compromise the computer and potentially expose confidential information. Depending on the malware involved, attackers may attempt to steal login credentials, monitor activity or gain unauthorised access to business systems.
Information obtained through a compromised device could then be exploited in further attacks, including attempts to manipulate payment instructions or access financial accounts.
The danger can extend beyond one employee if the affected computer is connected to shared business systems or contains credentials that provide access to other resources.
Mapusa Businessman Reportedly Loses ₹2 Crore
The warning follows a case involving a businessman from Mapusa who reportedly lost ₹2 crore in a suspected cyber fraud. The cybercrime cell has also received three additional complaints linked to similar methods, according to the supplied report.
Authorities have highlighted the way such schemes exploit confidence in workplace communication. Employees may be more likely to follow an instruction when they believe it has come directly from a senior manager, particularly if the message appears urgent or relates to an important business task.
However, the available report does not provide a complete transaction-by-transaction account of the Mapusa case or specify the individual losses alleged in the other complaints. The precise methods used to execute the reported ₹2 crore fraud should therefore be confirmed through official updates.
The cases underline the importance of investigating both the initial deception and any subsequent access to company systems or financial accounts.
Why Corporate Computers Are Attractive Targets
Business computers can contain email conversations, customer information, employee credentials, financial records and payment-related documents. Access to these resources can give criminals opportunities to impersonate employees, exploit trusted relationships or attempt unauthorised transactions.
The risk increases when an organisation relies on a single communication channel to verify instructions or allows one person to initiate and approve a significant payment without independent checks.
The warning also applies to communications received through WhatsApp, email and voice calls. A familiar name, profile picture or apparently credible message is not sufficient proof that a request is genuine.
For businesses, the incident reinforces the need to combine employee awareness with technical safeguards and clear internal procedures for handling sensitive information.
Precautions Employees and Businesses Should Take
Goa Police have recommended verifying unexpected requests involving ZIP files through a known telephone number or another trusted communication channel before opening the attachment. Employees should not disable antivirus protection or bypass security procedures merely because a request appears to come from a senior official.
Businesses can reduce their exposure by implementing several practical safeguards:
Verify unusual instructions: Confirm unexpected requests directly with the person concerned using previously verified contact details.
Use dual payment authorisation: Require a second authorised person to review significant or unusual transfers.
Separate financial responsibilities: Avoid allowing one employee to control every stage of a payment.
Strengthen endpoint security: Keep operating systems and security software updated, and restrict access to sensitive systems.
Train employees: Conduct regular awareness sessions covering impersonation, suspicious attachments and social engineering.
Establish a reporting process: Make it easy for employees to report suspicious messages quickly without fear of blame.
These controls can help reduce the likelihood that a single deceptive message will lead to a major financial or operational loss.
What to Do After Opening a Suspicious Attachment
Employees who suspect they have opened a malicious file should notify their IT or cybersecurity team immediately. Following the organisation’s incident-response procedure, the affected device should be isolated from networks where appropriate, while avoiding actions that could destroy evidence.
If financial information or payment credentials may have been exposed, the organisation should alert its finance team and contact its bank promptly to assess the risk and seek protective action.
Where a financial cybercrime has occurred in India, victims can report it through the national cybercrime helpline at 1930 or the official portal at https://cybercrime.gov.in.
Businesses may also need professional support to review financial records, identify suspicious transactions and assess potential losses. A structured financial investigation can be relevant when examining questionable financial activity, alongside appropriate cybersecurity and law-enforcement support.
Goa’s Wider Cybercrime Detection Challenge
The supplied report cites police figures showing that 202 of the 556 cybercrime cases registered in Goa since April 2022 had been detected, representing approximately 36% of the total.
For the period from January 2025 to August 2026, the reported detection rate rose to 44%. However, 171 of the 306 cases registered during that period were still awaiting detection, according to the figures provided.
These statistics illustrate the investigative challenges associated with cybercrime, where digital evidence, financial transactions and potentially cross-border activity can complicate efforts to identify suspects.
The figures should be understood in the context of the reporting period and the definition of a “detected” case used by the police. They do not, on their own, establish the outcome of any individual investigation.
Conclusion: Verify Before You Trust a Workplace Message
The reported ₹2 crore fraud has prompted renewed attention to the risks posed by executive impersonation and malicious workplace communications. The “boss scam” demonstrates how criminals may exploit professional trust to target both individuals and business finances.
Employees should independently verify unusual instructions, especially those involving attachments, credentials or payments. Businesses, meanwhile, need layered security measures, clear authorisation procedures and a prompt response plan for suspected incidents.
As cybercriminals continue to exploit everyday digital communication, verification and preparation remain important safeguards against potentially costly fraud.