Gang with China links busted in Rs 1.95-crore whale phishing fraud

The fraud began with a WhatsApp message sent to the accounts manager from a number carrying the photograph of the firm’s partner as its display picture. The sender asked whether the employee had reached the office and then instructed him to transfer Rs 95 lakh for an ongoing Kothrud project. The accounts manager transferred the money to the bank account provided by the fraudster.

A few hours later, the same person instructed him to transfer another Rs 1 crore. When the employee asked about Tax Deducted at Source (TDS) on the transaction, the fraudster assured him that he would take care of it, following which the second transfer was made.

The fraud came to light when the impersonator subsequently sought another transfer of Rs 1.9 crore. The accounts manager then contacted the firm’s partner directly on his landline and learnt that he had not issued any of the earlier instructions. Police subsequently contacted the banks where the fraudulently transferred funds had landed and initiated action.

Police said such frauds can involve spoofed emails, WhatsApp messages using stolen display pictures, Microsoft Teams or compromised phone and device sessions.

Whale phishing, also known as spear phishing or a CEO scam, involves highly targeted attempts to deceive senior or financially authorised personnel in companies into transferring money or sharing sensitive information. The term refers to the targeting of high-value individuals within an organisation.

Since 2022, the Pune City and Pimpri Chinchwad police have together registered close to a dozen cases of whale-phishing attacks.