A. Cover Story

[A.1] What is Boss Scam?

The “Boss Scam” or CEO/MD Impersonation Fraud is a sophisticated cyberattack where criminals pretend to be a high-ranking official of the company and trick the employees (usually from finance) into transferring the money to the fraudster’s account.

SEBI has issued a press release dated July 17th, 2026, cautioning the regulated entities and listed companies against the Boss Scam. Let us try to understand how this Boss Scam works, the two strategies used by the fraudsters, with examples.

The primary goal of the Boss Scam is to steal money by exploiting trust and technology. The scammers target the psychology of the employees to obey the boss and combine it with advanced technologies like AI and malware to make the request for money appear one hundred per cent legitimate.

There are two strategies adopted by the scammers. In the first method, the scammer never hacks the victim’s computer. They use Artificial Intelligence to mimic the voice of the CEO or a video or the presence. The scammer contacts the finance officer or any other subordinate via WhatsApp, email, or other platforms like Microsoft Teams. They claim to be in a meeting or travelling or otherwise unavailable to take a normal call, but are in urgent need of a confidential fund transfer. The scammer calls the victim using AI sound exactly like the CEO or might initiate a video call where an AI-generated video of the CEO speaks to him. They may create a fake WhatsApp/Telegram group. The CEO emphasises that the transaction is Unpublished Price Sensitive Information (UPSI) and must be kept secret, preventing the employee from asking for help from HR or IT.

For example, Priya, a Finance Manager at a listed company in Mumbai, receives a WhatsApp message from a number she thinks belongs to her CEO, Mr Sharma, as the profile picture is a real photo of Mr Sharma. The message says, “Priya, I am in a critical board meeting. We need to move ₹5,00,000 to a vendor immediately to secure a deal. Treat this as highly confidential (UPSI). Do not tell anyone to avoid any liability under SEBI Regulations.” When Priya hesitates, Mr Sharma calls her on WhatsApp video. She sees his face and hears his voice. Mr Sharma looks stressed and says, “Priya, the deal is falling, and we have to transfer the funds immediately. I will sign the authorisation later on reaching the office.” Priya transfers the money, thinking she is helping her boss. The money is gone within minutes.

In the second method, the strategy is more technical. The scammer tries to infect the victim’s computer to steal their digital identity. The scammer sends a message to the finance officer or the employee with a compressed .zip file. The .zip file contains an executable .exe file disguised as a document and a Dynamic Link Library .dll file that helps run the malware. These files are sent under the pretext of “Here are the signed documents for the transfer” or “Review the confidential audit report”. When the finance office extracts and opens the file on a Windows PC, a trojan installs silently and steals the WhatsApp Web session tokens. This enables the scammer to get full access to the finance officer’s WhatsApp account from their device. They can see all the chats, including those with the actual CEO. The scammer can also secretly change the contact details of the CEO’s number in the victim’s phone with different credentials and save their own number as the CEO. Once the scammer is logged into the victim’s WhatsApp, they can message other employees or the victim themselves, instructing them to transfer funds.

For example, Rahul is an Accounts Executive. Rahul gets the documents from the CEO. Under a false impression, Rahul downloads the file to his laptop and double-clicks to open it. The hacker logs into Rahul’s WhatsApp from their own phone and instructs them to transfer the funds.

The scam is considered to be dangerous as trust is exploited. Employees are trained to obey the CEO, and the UPSI angle stops them from verifying the transaction. Deepfake makes it impossible to tell if the voice or video is real. Once the money is moved to the mule’s account, it is often washed through crypto or multiple bank accounts before the company realises that the money is gone.

SEBI, through its press release, has advised that if any employee or officer of the company receives a money transfer request from a senior official, then they should call the person on a known saved number and not rely on the number in the chat. Any file received from unexpected sources, even if they claim to be the CEO should be verified via phone first. The employees should log out of WhatsApp web sessions if they are not using it actively. The listed companies should adopt a policy where any fund transfer requires verbal confirmation and a secondary approval from a different executive. In case of any fraud, the scam should be immediately reported to the Indian Cyber Crime Coordination Centre at 1930 or www.cybercrime.gov.in.

B. Case Laws

[B.1] A company cannot challenge the tender terms after participation in the tender process and accepting the terms

The High Court of Karnataka in Manipal Technologies Ltd v. Bank of Baroda (July 16th, 2026) held that a company that had participated in the tender process and submitted an undertaking to comply with eligibility conditions, including the disclosure about promoters, could not subsequently challenge those conditions after it was disqualified.

As per the facts of the case, Manipal Technologies Ltd (MTL) applied for a bank tender. The terms of the tender clearly stated that if the company or its promoters were defaulters (owed money), then they would be disqualified. MTL signed the agreement saying that it followed the rules. Later on, MTL was disqualified because one of its key directors had financial issues.

MTL went to court claiming that the rule was unfair. The court, after an appraisal of the facts, held that, as MTL had participated voluntarily and agreed to the rules, they cannot challenge those rules after being rejected.

The court rejected MTL’s argument that the director in issue was no longer listed as a promoter of the company in official records and that he had been changed to a professional director. The court alleged that reality was more important than the paperwork. The director still held the position of Executive Chairman and Whole-Time Director. He made all the major decisions and controlled the company.

This finding of the court is important for the definition of promoter under section 2(69) of the Companies Act, 2013 as well. It clarifies that a promoter isn’t just a name in the list. It is anyone who has de facto control over the company.

[B.2] Penalty for regulatory breach by a mutual fund is not connected with the consequences of such breach on investors

The Supreme Court’s judgment in Nilesh Shah v. SEBI (July 13th, 2026) is a classic example of what happens when good intentions meet regulatory breach. In this case, the Supreme Court rejected the defence given by the Kotak AMC that their regulatory breach should be excused as it saved the investors from loss. Thus, even when fund managers act in good faith to prevent investor losses, they cannot bypass statutory mandates.

As per the facts of the case, a dispute arose from six close-ended fixed-maturity plans launched by Kotak Mahindra Asset Management Company (AMC) between 2013 and 2016. The AMC had invested in zero-coupon NCDs issued by Essel Group Entities, which were secured by a pledge of Zee Entertainment Enterprises Limited (ZEEL) shares. While the fixed-maturity plans of the AMC had matured in April 2019, the underlying NCDs of Essel Group Entities had not been redeemed. The AMC did not invoke the pledge of ZEEL shares as the share prices had crashed. The AMC, on its own, extended the maturity of schemes without a formal roll-over process and withheld the payments to the unitholders. SEBI penalised the AMC, Trustee and the executives on the grounds of lack of due diligence, violation of winding up regulations and inadequate disclosure to the unit holders. On appeal, the Supreme Court dismissed the contentions of the AMC that extension of maturity was to protect unit holders, as the security of ZEEL shares was inadequate and they were able to recover the entire amount by extending the time.

The issue-wise analysis of the case is as follows:

Issue No. 1: Whether the appellants failed to exercise due diligence and care in investing in ZCNCDs issued by Essel Group entities, thereby violating Regulation 25(16) read with the Fifth Schedule of the SEBI (Mutual Funds) Regulations, 1996?

The Court upheld the findings of the Whole Time Member (WTM) of SEBI. The Investment Committee (IC) of the AMC invested in financially distressed Essel Group entities (Konti and Edison), which were consistently making losses. The Court noted that the rationale for the investment was not the financial health of the issuers but the reliance on the collateral (ZEEL shares) at a 1.5x cover. Crucially, the internal approval notes revealed that the IC was unaware of the specific issuer entity at the time of approval and failed to analyse credit, liquidity, or interest rate risks. Furthermore, the investment violated the 2019 circular requiring a 4x cover for equity-backed credit enhancements, as the actual cover was only 1.5x.

The Court emphasised that the focus must be on diligence, not dividends. Since the appellants failed to perform basic risk analysis and ignored the financial instability of the issuers, the breach of the due diligence obligation was established.

Issue No. 2: Whether the appellants violated Regulations 33(4) and 39 of the SEBI (Mutual Funds) Regulations, 1996 by extending the maturity of ZCNCDs beyond the scheme maturity date without following the roll-over process?

The schemes were close-ended and mandated to be wound up upon maturity in April 2019. The Court observed that the only exception to immediate winding up is a formal roll-over under Regulation 33(4). The Appellants admitted that no such roll-over process was followed, no notifications were issued, no written consent was obtained, and the Scheme Information Documents did not provide for such a course of action.

The appellants argued that other funds were also invested in Essel and that their actions prevented investor loss. The Court rejected this, stating that negative equality cannot be claimed and that an illegality is not cured by the fact that others committed similar wrongs. Furthermore, the Court held that the regulatory framework is consequence-neutral. The fact that investors ultimately gained or did not suffer loss is irrelevant. The breach was the failure to wind up or formally roll over the scheme as per the statutory mandate. The Court described the breach as brazen and indefensible.

Issue No. 3: Whether the absence of loss to unitholders and the fact that they eventually gained from the Appellants’ actions constitute a valid defence against the imposition of penalties?

The appellants contended that since no investor suffered a loss and the breach resulted in a gain, no penalty should be imposed. The Court firmly rejected this argument, citing the Shriram Mutual Fund case. The Court reiterated that the statutory scheme is designed to enforce compliance irrespective of the outcome.

The Court reasoned that excusing a breach because it fortuitously resulted in profit would incentivise future breaches, leading from profit to greed, from greed to regulatory breach and from breach to systemic failure. Market integrity is the paramount consideration. The regulations do not distinguish between a breach resulting in profit and one resulting in loss. Therefore, the absence of investor prejudice or the presence of investor gain cannot serve as a shield to evade liability for a statutory violation.

Issue No. 4: Whether the Appellants could claim the benefit of SEBI’s Circular dated December 28, 2018, regarding the creation of a segregated portfolio to justify their actions?

The appellants attempted to argue that their actions aligned with the 2018 Circular on segregated portfolios. However, the Court noted a contradiction in their stance: previously, they had argued that their actions did not amount to segregation. More critically, the Court found that the Appellants failed to follow the mandatory procedure under the 2018 Circular. The Scheme Information Documents did not contain a provision for segregation, and the required steps (press release, trustee approval, intimation, allotment) were never taken. Since the Appellants admitted they did not segregate the portfolio, they could not claim the benefit of a circular that required strict procedural compliance which was absent. The Court held that the question of claiming such benefit cannot arise by any stretch of imagination.

Issue No. 5: Whether the Senior Executives and the Trustee Company are liable for penalties given their roles and the nature of the violations?

The Court held that the Trustee, holding funds in a fiduciary capacity, failed to independently assess whether the course adopted by the AMC was in adherence to regulations or in the best interest of unitholders. Instead of acting independently, the Trustee beelined the action. Regarding the Senior Executives, the Court emphasised that they are domain experts well-versed in securities law. It is unimaginable that they were unaware of the consequences of infringing the regulatory framework. By putting the future of unitholders at immense risk and adopting a course unknown to law, their conduct trod beyond condonable limits. The Court found no scope for interference with the penalties imposed on them, noting that the margin for error in such matters is virtually non-existent.

[B.3] Liability of Depositories under section 16 of the Depositories Act

A recent judgement of the Bombay High Court (CDSL v. Daksha Narendra Bhavsar, July 02nd, 2026) sparks a discussion on the liability of Depositories under section 16 of the Depositories Act, 1996. The simple rule enshrined in section 16 is that if any investor loses money or shares due to negligence by either the Depository or its Participant, the Depository shall be liable to pay for the loss. The law treats the Participant as the agent of the Depository. However, once the Depository pays the investor, the Depository can recover the damages from the Participant.

In this case, the investor, Ms Bhavsar, held her shares in a DEMAT account with BRH Wealth Kreators, who acted as both the broker and the Depository Participant for CDSL. She signed the power of attorney allowing the broker to handle her shares for legitimate trading purposes like buying/selling shares or meeting margin requirements.

In 2019, BRH used the power of attorney to transfer Ms Bhavsar’s shares from her account into their own corporate account. Later on, BRH pledged these shares to HDFC Bank to get a loan for themselves and not for the clients. BRH defaulted on the loan, and HDFC Bank sold the shares after invoking the pledge. Thus, Ms Bhavsar suffered a loss of securities.

CDSL argued that its role was restricted to record-keeping, and the initial transfer of shares was through a valid PoA. After the shares were in BRH’s account, they became BRH’s property, and the broker pledged them fraudulently. Thus, BRH was at fault. On the other hand, Ms Bhavsar argued that CDSL had failed to supervise BRH. CDSL failed to create an early warning system to prevent this kind of fraud in accordance with SEBI rules.

The High Court of Bombay ruled in favour of the investor and upheld the decision that CDSL must indemnify the investor under section 16 of the Depositories Act, 1996. The court reinforced the principle that Depository Participants act as agents of the Depository. If an agent commits a wrongful act while doing their business, then the principal can be held liable. The court also relied on directives issued by SEBI requiring the Depositories to set up an early warning mechanism. This mechanism was necessary to flag suspicious activities like the movement of a large quantity of shares from a dormant account. The court emphasised that the Depository Act is meant to safeguard the investors, and the law places a burden on Depositories to ensure their network is safe.

[B.4] Property transferred via mutation entries without a registered instrument declared as void under fraudulent transfer

On June 25th, 2026, the High Court of Bombay pronounced a judgement in re: Indage Vineyard (P) Ltd relating to fraudulent preference. The fraudulent preference is dealt with under section 328 of the Companies Act, 2013, which corresponds to section 531 of the Companies Act, 1956. This section hits a transfer of any asset or property just before the commencement of the liquidation process as a fraudulent transfer. The Tribunal, while exercising powers under this section, can declare the transaction as invalid.

As per the facts of this case, Indage Vineyard (P) Ltd was a private company wholly owned by the Chougule family (promoters). In 2008, the company bought agricultural land for about ₹84.5 lakhs. On April 30th, 2011, a winding-up petition was filed as the company was facing financial trouble. Just before the filing of the petition, the promoters passed a resolution to transfer the land to themselves. Interestingly, the promoters did not sign a registered sale deed or any other legal transfer document. On the other hand, as the promoters were resourceful, they managed to get the mutation entries at the Sub-Registrar’s office. This mutation was recorded on June 30th, 2011, two months after the winding-up petition. The promoters claimed that the company owed money to them for the loans they had given. However, they failed to provide any proof of how much money was owed, the valuation of the land and money trail where company owed money to them.

In 2023, the promoters tried to sell the land to a third person to raise money. They claimed that this transaction was to pay off creditors and save the company. The official liquidator went to court to get the transfer declared void.

The court, while ruling in favour of the official liquidator, ordered that the land records should be corrected immediately. It held that the transfer happened within six months of the winding-up petition without any proper documentation. Thus, it was squarely covered by fraudulent transfer. Even though the promoters owned the company, the assets of the company belonged to the creditors after the start of the liquidation process.

[B.5] Holding of 100% stake by employees of a company in another company does not establish a holding-subsidiary relationship

An interesting point arose in Jagdish Prakash v. SEBI (SAT - June 11th, 2026) regarding the holding-subsidiary relationship between two companies. As per the facts of the case, the Whole-Time Member (WTM) of SEBI alleged that a company named Educomp was the holding company of Edu Smart Services Private Limited (ESSPL), as the two shareholders/promoters of ESSPL were the long-standing employees of Educomp and Educomp provided capital and business to ESSPL. Thus, Educomp should have presented a consolidated financial statement, and the financial dealings between the two companies should have been treated as related-party transactions.

However, Educomp relied strictly on the statutory definitions of holding company and subsidiary company under the company law. It alleged that a company is a subsidiary of another only if the parent company owns more than 50% of the shares or the parent company has the authority to appoint or remove the majority of the directors. But in this case, Educomp owned zero shares in ESSPL, and the shares were owned by its two employees. It had no right to appoint or remove directors. Further, providing capital and business by Educomp did not result in control as per the statutory definition.

The SAT ruled in favour of Educomp as it held that a strict interpretation should be given to definitions of holding and subsidiary companies. If Educomp did not own any shares or had no authority to appoint or remove directors, then it had no control over ESSPL. Further, the surrounding circumstances, like providing capital or guarantees, did not create control. The law requires specific legal power and not just economic control.