Pune Poultry Firm Falls Victim to Sophisticated Whale Phishing Scam, Loses Rs 70 Lakh
A poultry company in Pune fell prey to a sophisticated variant of a whale phishing scam, where cyber fraudsters hacked and compromised the mobile phone of an accountant and tampered with his contact list to impersonate the company’s Chief Executive Officer (CEO), manipulating the accountant into transferring Rs 70 lakh to mule accounts.
An FIR in the case was registered on April 25, at the Cyber Crime police station of the Pimpri Chinchwad police by the CEO of the poultry products company in Ravet.
The fraudulent incident took place on the afternoon of April 15 when the accountant of the company received a WhatsApp message from a number which had the name and display picture of the CEO. The message even referred to a previous communication and then directed the accountant to transfer Rs 70 to a particular account. The accountant transferred the money. A while later, the same sender asked the accountant to transfer Rs 30 lakh to a different account. At this point, the accountant got suspicious and asked if such directions were being given. It came to light that the firm had been defrauded. The company officials subsequently approached the Cyber Crime police station of Pimpri Chinchwad police and an FIR was registered.
An officer who is part of the probe explained why this was a sophisticated variant of the scam, “In the conventional whale phishing scams, fraudsters typically rely on an unknown number using the CEO’s or company head’s display picture to appear credible and initiate fresh communication. This particular case involved a deeper compromise of the accountant’s phone, including manipulation of his saved contacts list. We have found that in the accountant’s phone which was hacked, the cyber fraudsters saved the actual number of the company CEO with a different name. They saved a fraudulent number with the CEO’s name and his display picture on WhatsApp. This significantly enhanced perceived authenticity.”
The officer added that cyber fraudsters also gained access to the accountant’s existing WhatsApp chats with the CEO and continued the conversation within the same thread, mimicking prior communication patterns and context. “This made the fraudulent instruction appear as part of an ongoing, legitimate exchange rather than a suspicious new request,” he noted.
The Whale Phishing attacks, also known as ‘spear phishing attacks’ or ‘CEO scams,’ are highly focused on specific individuals in companies and corporate entities. These scams specifically target senior officials of the companies who handle finances. The term “whale phishing” emphasizes the targeting of key figures in the companies. Since 2022, the Pune City and Pimpri Chinchwad police have together registered more than a dozen cases of ‘whale phishing attacks’.
In one such case, Pune-headquartered global vaccine major Serum Institute of India was cheated of Rs one crore in 2022. In another case in January 2024, a real estate company in Pune lost Rs four crores in a Whale Phishing attack.
