Decoding Naresh Gujral’s Rs 7.68cr ‘whaling’ scam that ‘exploits’ WhatsApp

The cyber attack struck on June 12, when his company’s CFO, Shubham Singh, received WhatsApp messages that appeared to come directly from Gujral. Trusting the digital persona, the CFO complied with urgent directives to deposit funds via four separate Real-Time Gross Settlement (RTGS) transactions into designated bank accounts. 

The multi-crore fraud only came to light four days later, on June 16, when the employee casually mentioned the massive transfers to Gujral’s daughter, which prompted a swift escalation to the authorities.

An emergency complaint was filed through the National Cybercrime Reporting Helpline (1930), after which the Delhi Police’s specialised cyber unit, Intelligence Fusion and Strategic Operations (IFSO), swung into action to trace the lost money. Investigators successfully managed to track the mule accounts and block a massive portion of the stolen funds. 

“On the complaint of Naresh Gujral, an FIR was registered on June 16. Immediate action was taken, and an amount of Rs 4.28 crore out of the total defrauded amount of Rs 7.68 crore has been marked as a lien/hold in various banks. Efforts are being made to apprehend the persons involved in the fraud,” stated Deputy Commissioner of Police (IFSO) Vinit Kumar.

How scammers pulled it off with ‘whaling’

Gujral’s firm witnessed a specialised form of spear-phishing, commonly known as “Whaling” or CEO Fraud. 

Unlike generic phishing attacks that target a wide audience, whaling specifically targets high-profile executives or individuals with authorised access to substantial corporate funds (in this case, his finance team).

1. Account hijacking:  According to an early investigation, the fraudsters either hacked into Naresh Gujral’s WhatsApp account or set up a spoofed profile using his name and profile picture. By imitating Gujral’s identity, the scammers bypassed the initial doubts of the target.

2. Targeting the most powerful position: The scammers did not target Gujral directly. Instead, they targeted his Chief Financial Officer (CFO), Shubham Singh. In any corporate setup, the financial head holds the keys to the treasury, making them the target for stealing credentials.

3. The classic ‘urgency’ narrative: On June 12, the CFO received a WhatsApp message from the account impersonating Gujral, stating an urgent need to deposit money into a bank account via RTGS. This triggers a psychological need to comply with the authority’s urgent instructions to make the victim bypass standard operating procedures.

4. Money trail via mule accounts: After reacting to the message, the CFO executed four separate RTGS transactions totalling Rs 7.68 crore. The funds were immediately routed into three to four pre-arranged corporate or individual bank accounts, often referred to as “mule accounts”. These are managed by the fraudsters to disrupt the transaction trail and complicate law enforcement tracking.

Where the victim made mistakes

– The single most significant fault was executing a multi-crore transaction based entirely on a WhatsApp text message.

– The CFO failed to consider a secondary validation check. A simple, direct phone call or a face-to-face confirmation with Gujral would have immediately exposed the fraudulent nature of the text message.

– The company didn’t have any dual verification process in place too.

– The fraudulent transfers took place on June 12, but the CFO did not mention the transactions to Gujral’s family until June 16, thus including a four-day delay. In cyber fraud, such amount of time helps the fraudsters with a clean window to withdraw or clean stolen funds.

What can you do to avoid such cyber fraud

Protecting yourself from such sophisticated cyber scams is tricky, but you can rely on basic verification methods to ensure caution. Hence, whether you are protecting your personal savings or safeguarding a company’s treasury, here are a couple of steps to consider:.

Turn on two-step verification (2FA): Go into your WhatsApp, Telegram, email, and banking apps right now and enable two-step verification. This requires a PIN that you need to enter every time you log in. This means that if scammers manage to clone your SIM card or trick you out of an initial OTP, they still can’t access your accounts.

The ‘Voice call’ rule: If a friend, family member, or your boss messages you on a texting app asking for money, an urgent UPI transfer, or an emergency favour, you should stop. Call them directly on their regular cellular network (not via WhatsApp call, as the account might be hacked) to confirm it is actually them making a request.

Beware of the ‘urgency’ trap: Scammers thrive on creating artificial panic (e.g., “I’m in a meeting and need this paid immediately,” or “My account is blocked, help!”). If a message demands immediate financial action, treat it as a massive red flag.

Share only what’s necessary: Fraudsters scrape public social media profiles to copy display pictures, learn who your family members are, and understand corporate hierarchies. Tighten your privacy settings so only your contacts can see your profile picture, status, and personal details.

Emergency action: If you or your organisation does fall victim to a financial cybercrime, every minute counts. Immediately dial 1930 (the National Cybercrime Reporting Helpline in India) or log onto ‘cybercrime.gov.in’ within the first 1 to 2 hours. This gives law enforcement the best chance to freeze the funds in the banking system before the scammers can withdraw them. If the funds have not yet been physically withdrawn from the ATM or moved outside the formal banking system, the police can mandate an immediate freeze.