As accountant’s phone is hacked, sugar trader loses Rs 3 crore in whale phishing attack

A Pune sugar trader suffered a significant financial loss of Rs three crore in a sophisticated whale phishing scam within an hour on Monday. The cybercriminals managed to hack the accountant's phone and impersonate the trader to initiate three money transfers from the company's bank account. The incident occurred when the accountant received a WhatsApp message from an unknown number, supposedly from the trader, requesting details about the firm's internet banking balance.

Upon receiving the response, the accountant, trusting the messages to be from the trader, proceeded to make three money transfers of Rs one crore each. The fraud was discovered when the trader, contacted by the accountant for a GST number related to the transaction, denied initiating any such transfer. Upon examining the accountant's computer and mobile phone, the company found evidence of the three fraudulent transfers.

The accountant had also received a suspicious file named "Transaction_Details_31/08/2026 img" days before the incident. The cybercriminals used malware to compromise the accountant's phone and gain access to the contacts, allowing them to carry out the fraudulent transfers. Police have registered a case under the Information Technology Act and the Bharatiya Nyaya Sanhita for cheating and criminal conspiracy.

They have assigned an officer to investigate the incident. Cyber police advise companies to be cautious when receiving payment instructions via messaging applications and to independently verify such requests via phone calls. Companies should also regularly review active WhatsApp Web sessions, enable multi-factor authentication, restrict the installation of unverified software, and conduct periodic cyber-security audits.

Finance teams should adopt dual-approval mechanisms for high-value transactions and receive regular awareness training to recognize phishing attempts and compromised accounts.