The whale phishing began with a WhatsApp message to the complainant from a number showing the company’s partner’s photo. The message asked: “Have you arrived at the office?” After the complainant replied yes, the sender told him that for an ongoing project in Kothrud, an amount of Rs 95 lakh had to be transferred to an account. Believing the message to be true based on the reference to the Kothrud project, the account manager transferred the money to an account provided by the sender posing as the company’s partner. An investigation revealed that the account was a mule account registered in Karnataka.

A few hours later, the sender asked the complainant to transfer an additional one million rupees to another account. When the complainant asked the shipper about TDS (tax deducted at source), the shipper said he would take care of that aspect. Believing all of this to be authentic, the complainant made the transfer. Hours later, the fraudster asked the complainant to transfer Rs 1.9 million. Only this time the plaintiff checked with the partner for his landline number and discovered that he had not previously been given instructions to make a transfer. The company approached the police and an FIR was registered. Authorities said an investigation has been launched into the phone number and accounts used by the scammers.

In whale phishing attacks, also known as spear phishing attacks or CEO scams, individuals within companies are specifically targeted. These scams target senior company officials who handle finances. The term whale phishing places emphasis on targeting key figures in companies. Since 2022, Pune City and Pimpri Chinchwad police have together recorded nearly a dozen cases of whale phishing attacks. In one such case, Pune-based global vaccine major Serum Institute of India was defrauded of Rs 1 crore in 2022. In another case, in January last year, a real estate firm in Pune lost Rs 4 crore.

In February 2024, a young woman identified as Saniya Mustakim Siddique (21) was arrested in Faridabad, Haryana, by cyber investigators of Pune City Police in a Rs 4 million whale phishing scam. She was identified as a key suspect based on technical analysis of the phone numbers and bank accounts used in the whale phishing attack. While being taken to Pune by Duronto Express, she escaped from the train at Kota station in Rajasthan on February 18. After searching for her for months, she was finally arrested in December 2024.

Last year, an attempted whale phishing attack targeted the Center for Materials for Electronic Technology (C-MET), a key research institution under the Union Ministry of Electronics and Information Technology. The cybercriminals, posing as the organization’s CEO, sent emails to more than two dozen scientists attempting to trick them into transferring money.