A Pune CFO sent Rs 56 lakh after a Microsoft Teams message from a fake CEO profile. A second Rs 1.5 crore request made her call the real CEO. What happened.
Social Engineering Examples·3 sources
On the morning of 13 July 2026, the chief financial officer of an Italian engineering company's Pune office got a Microsoft Teams message from a profile with her CEO's name and photo. He was busy with a government project, it said, and she needed to transfer Rs 56 lakh to two bank accounts. She did. The next morning came a second request, for Rs 1.5 crore. That one made her suspicious. She called the real CEO, found out she'd been tricked, and went to the police. Status: Reported to police, under investigation.
| When | What happened |
|---|---|
| 13 July 2026, morning | A Teams message from a profile with the CEO's name and photo asks her to send Rs 56 lakh to two accounts. She is working from home and pays |
| 14 July 2026, morning | A second message asks for Rs 1.5 crore |
| Same day | She calls the real CEO, learns it's a scam, and goes to the police |
| 19 July 2026 | The Indian Express reports the case; Pimpri-Chinchwad police are investigating |
The reporting doesn't explain how the fake profile was created, whether any account was hacked, or how the scammers knew who to target. No recovery or arrest had been reported.
Tip: when the "boss" messages about money and says they can't talk, that's exactly the moment to call them.
The second request was the scammers' mistake. Rs 1.5 crore, a day after Rs 56 lakh, was big enough to make her stop and check.
Around the same time, SEBI cautioned regulated entities and listed companies about fraudsters posing as CEOs or managing directors, after an alert from India's Indian Cyber Crime Coordination Centre (I4C). The warning covered email, WhatsApp, Teams and social media, with newer tricks including deepfakes and malicious downloads that hijack WhatsApp Web sessions. The reporting doesn't say this case prompted the warning.
See also how to prevent CEO fraud and the WhatsApp CEO fraud case in India.
A scam where criminals pose as a company's CEO or another senior leader, usually on email or chat, and ask an employee to make an urgent payment.
Rs 56 lakh, sent to two bank accounts. A second request for Rs 1.5 crore was not paid.
The second, larger request made her suspicious, so she called the real CEO, who knew nothing about it.
Yes. A profile with a copied name and photo can look like a colleague. Check payment requests by phone, whatever app they arrive on.
Social Engineering Examples. “Pune CFO loses Rs 56 lakh to a Microsoft Teams boss scam (2026)”. Accessed 3 November 2026. https://socialengineeringexamples.com/pune-teams-boss-scam-cfo-2026
the attacker used the CEO's name and photograph. The July 19 report does not establish how those details were obtained.
Public executive identifying information (a CEO's name, role, and photograph on a company website, LinkedIn, or in press coverage) is very difficult to eliminate for any public-facing senior executive; the realistic control assumes this exposure exists and instead hardens the payment-verification process it later gets used against, per Stage 5's countermeasure.
a Microsoft Teams profile displayed the real CEO's name and photograph; the report does not establish how the profile was created or whether an account was compromised.
Enterprise Microsoft 365/Teams administrators can enable external-sender and unverified-account warning labels, restrict who can message internal staff under an executive's display name from outside the tenant, and monitor for newly created accounts impersonating senior officials.
the CFO received the message through Microsoft Teams while working from home.
Train employees that a message's legitimacy depends on verified sender identity, not on which application it arrives through; internal collaboration tools like Teams should receive the same scrutiny for high-stakes financial requests as external email.
the message said the CEO was busy with a government project and instructed the CFO to transfer Rs 56 lakh to two accounts.
Treat an "unavailable executive plus urgent, confidential payment" narrative as a fraud warning sign and require finance staff to verify the request through an independent channel before acting.
Payment instruction and fund transfer (objective completion, first tranche): the CFO transferred Rs 56 lakh to two specified bank accounts without an out-of-band verification call, completing the attacker's financial objective for the initial request.
Require mandatory out-of-band verification, a phone call to a known, pre-established number rather than a reply in the same chat thread, before executing any executive-originated wire transfer; applied here, this single control would have prevented the entire Rs 56 lakh loss.
a second message the next morning demanded Rs 1.5 crore. The CFO became suspicious, called the real CEO and then approached police.
require a callback to the known executive contact and independent authorization before releasing funds. In this incident, the CFO's callback exposed the fraud before the second demand was paid.
Browse by what this case has in common with others in the library.
Censys traced a USPS 'package awaiting action' smishing kit to 682 lookalike sites that streamed card numbers as victims typed.…
Dubai Police raided nine pig butchering centres and arrested 275, and San Diego charged six alleged scam-compound managers and recruiters.…
Fraudsters swapped a former MP's number in his company's phone but kept his photo, then ordered Rs 7.68 crore in…
A fraudster spoofed Wells Fargo's real 800 number nine minutes after a legitimate advisor call, phished a 2FA code from…
Fake finance "directors" in WhatsApp groups steered 18+ US investors to NanoBit, a crypto platform that never traded. The SEC…
Fraudsters posing as Tecnimont's group CEO, other executives, and a fictitious Swiss lawyer used spoofed emails and a staged series…
A fraudster posing as AFGlobal's CEO, backed by a fake KPMG "attorney," pressured the accounting director into wiring $480,000 to…
Anthropic says a suspected Chinese state group conned Claude Code with a fake pentest story and let it run most…
The FTC's first-ever case under the FACTA Disposal Rule: a Northbrook, Illinois mortgage lender repeatedly dumped intact customer credit reports.
A respected Kansas bank CEO was groomed on WhatsApp into a crypto scam, wired $47.1M of bank funds in 11…
DOJ prosecutions of FIN7 members Fedir Hladyr, Andrii Kolpakov, and Denys Iarmak produced guilty pleas and prison sentences. The records…
A Chicago hairstylist lost $20,000 to a Phantom Hacker scam. A caller claiming to be Bank of America said a…
Fraudsters posing as Tecnimont's group CEO, other executives, and a fictitious Swiss lawyer used spoofed emails and a staged series…
Fraudsters swapped a former MP's number in his company's phone but kept his photo, then ordered Rs 7.68 crore in…
Hours before Maharashtra's 2024 assembly election polling, BJP-amplified audio clips purporting to catch two opposition leaders discussing a bitcoin-funded election…
A Bengaluru retiree lost Rs 6.88 lakh after a deepfake Facebook ad of India's finance minister pitched a fake SBI-linked…
The CEO of a UK energy firm was tricked into wiring €220,000 (~$243,000) to a Hungarian account in March 2019…
A fake email posing as DTC gave JE Cleantech false wire instructions for its 2026 dividend, diverting US$794,934 and delaying…
In 2025 the FBI, FTC and USPIS warned of unordered packages with QR codes that lead to phishing sites or…
In the PG&E scam, a caller claiming to be from the utility threatens to cut the power today. Then a…
A convincing fake ChatGPT download site, openew[.]app -- reached in part via an AI-generated fake outage page rendered on a…
Google found PROMPTFLUX, a dropper that asks Gemini for antivirus-evasion code mid-run. Its self-rewrite feature was switched off and it…
Social Engineering Examples