Finance, HR teams face growing threat from AI-Powered ‘Boss Scams’

Cybercrime experts have raised alarm over the growing misuse of AI-driven deepfake technology by fraudsters to impersonate company executives and trick employees into authorising payments or sharing sensitive data. Finance, HR and procurement teams are increasingly being targeted in ‘Boss Scam’ cases.

Hyderabad: The rapid rise of Artificial Intelligence (AI) is creating new challenges for businesses, with cybercriminals increasingly using deepfake technology to impersonate company executives and target key departments responsible for financial transactions and sensitive data.

Cybersecurity experts warn that finance, human resources and procurement teams have emerged as the primary targets of so-called ‘Boss Scam’ or ‘CEO Impersonation Fraud’, in which fraudsters use AI-generated voice or video messages that appear to come from senior executives.

---

The attackers typically create a sense of urgency, directing employees to approve payments, alter vendor bank details, release payroll information or share confidential corporate records.

According to Cybercrime officials, finance departments are particularly vulnerable because they handle fund transfers and vendor payments on a daily basis.

Procurement teams may be tricked into changing supplier account details or processing fraudulent invoices, while HR personnel could be targeted to gain access to employee records, salary data and other sensitive information.

The threat is becoming more serious as many organisations continue to operate in remote and hybrid work environments. “In traditional office settings, employees could easily verify unusual requests by speaking directly with managers. However, in distributed workplaces, staff members often rely on emails, phone calls, messaging platforms and video conferences for approvals and decision making,” said a senior police official.

Cybercrime authorities have urged companies to strengthen verification procedures for high-value transactions and sensitive requests. They have also recommended safeguards including multi-person approvals, independent verification through separate communication channels and mandatory callback procedures before processing payments or sharing confidential information.

They have cautioned that as AI tools become more sophisticated and widely available, organisations can no longer rely solely on familiar voices or faces to confirm identity.