WhatsApp 'boss' scam: Mumbai police arrest six; accounts linked to 255 complaints, ₹72 crore

Illustrative stock image via Unsplash. It does not depict the organisations named.

A Mulund accountant paid ₹10 lakh after a WhatsApp message from an unknown number showing his employer's photo. Following the money, Mumbai police say they found 60 bank accounts linked to 255 complaints. What happened, and the check that stops it.

01 / What happened

Mulund police in Mumbai have arrested six people in a case that began with one WhatsApp message, the Free Press Journal and The420.in reported on 29 and 30 October 2026.

• The fraud: on 30 July, an accountant at a firm got a WhatsApp message from an unknown number that showed the company owner's photo. Believing it was his employer, he transferred ₹10 lakh from the company's account.
• The trail: police traced ₹5.50 lakh to a bank account in Meerut, Uttar Pradesh, from which it had been withdrawn by cheque.
• The arrests: three people in Meerut, then one each in Ghaziabad, Vadodara and Kandivali in north Mumbai. Police recovered ₹5.50 lakh and seized five phones.
• The wider network: one accused's phone held details of 11 bank accounts linked to 182 complaints in 21 states; another's held 49 accounts linked to 73 complaints. 'Together, the 255 complaints involved suspected cyber fraud amounting to approximately Rs72 crore,' Deputy Commissioner of Police Abhay Singh Deshmukh told the Free Press Journal.

02 / How the network worked, according to police

Police say the group bought and sold bank accounts and SIM cards through Telegram groups. On some account holders' phones it installed malicious APK files, so it could control those phones and use the accounts to receive stolen money. The money was moved through several accounts, then withdrawn in cash or converted into the cryptocurrency USDT. Police suspect operators abroad; the Free Press Journal reports they suspect China.

03 / Why it matters now

In the run-up to Diwali, when many businesses pay bonuses and settle dues, an urgent 'pay now' message from the boss can look routine. The Home Ministry's Indian Cyber Crime Coordination Centre (I4C) and the market regulator SEBI both warned this year about the 'Boss Scam', in which fraudsters pose as a director or CEO on WhatsApp. Both say the defence is to check payment instructions with the person directly.

The case also shows the other half of such frauds: people who sell or rent out their bank accounts and SIMs, which then carry other people's stolen money.

04 / Confirmed vs. claimed

Reported (the Free Press Journal and The420.in, citing Mumbai police): the ₹10 lakh fraud, the six arrests, the recovery, the 60 accounts and 255 complaints, the Telegram trade, the APKs and the USDT route. We could not find a Mumbai Police press release. The ₹72 crore is the total in the complaints linked to these accounts, not a finding that the six took it; police are still working out each person's role. The six are accused, not convicted. The Free Press Journal names them, but no official release we could check does, so we do not. Reports differ on where some of them live. Claimed: the China link is a police suspicion under investigation. Confirmed (official): the I4C and SEBI warnings and advice on boss scams (PIB, 7 August 2026; SEBI press release No. 40/2026, 17 July 2026).

05 / What to do

• No payment on a WhatsApp message alone. I4C advises firms to verify any urgent fund-transfer instruction received on WhatsApp or e-mail by a direct voice call or in person before acting. Call back on a number you already had, not one in the message. Our call-back checklist for firms turns this into an office rule.
• Tell everyone who makes payments, including the accountant at a small firm or shop, that the owner's photo on a new number proves nothing.
• Never sell, rent or 'lend' your bank account, ATM card, cheque book or SIM. Fraud money passes through such accounts: see why renting out your account is a crime.
• Never install an APK file someone sends you. Installed one already?
• Paid already? Call 1930 at once, then your bank. Our lost-money checklist covers the first hour.