Background and Timeline

In October 2025, a senior manager at a Chennai-based cement company fell victim to a sophisticated man-in-the-middle (MitM) cyber fraud. The manager, Pranadarthiharan, received a WhatsApp message from a number impersonating his company’s CEO, Krishnamoorthy Suresh, instructing him to transfer ₹80 lakh to a bank account under the name SIRI Enterprises. Trusting the apparent authenticity of the message and failing to verify with the actual CEO, the manager executed the transfer.

Modus Operandi

The fraudsters employed a classic MitM attack, leveraging social engineering and WhatsApp impersonation. By spoofing the CEO’s identity, they manipulated the victim into authorizing a large fund transfer. The funds were then dispersed into multiple mule accounts, primarily in Karnataka, and withdrawn via cheques. The use of WhatsApp, rather than email, reflects the evolving tactics of cybercriminals, who increasingly exploit popular messaging platforms for business email compromise (BEC) and MitM scams.

Number of Victims and Financial Impact

The immediate financial loss was ₹80 lakh. Investigation revealed that ₹5.48 lakh was credited to the SBI account of Mohammed Arbaz in Mysuru, with ₹5.3 lakh withdrawn via cheques, and ₹10 lakh was credited to Hasheer Akthar’s Bank of Baroda account, also withdrawn in full. The involvement of multiple accounts and prior complaints against the accused suggest that this was not an isolated incident, and the suspects may have facilitated similar frauds in other states.

Investigation Progress and Agencies Involved

Upon realizing the fraud, the victim lodged a complaint with the Greater Chennai Police Commissioner. The Central Crime Branch’s Cyber Crime Police traced the money trail to Mysuru and Bengaluru, leading to the arrest of Mohammed Arbaz and Hasheer Akthar, both 21. Arbaz had prior complaints against him in Tamil Nadu, Telangana, and Andhra Pradesh, indicating a pattern of using his accounts as money mules for cybercriminals. The investigation highlighted the use of fake firms, mule accounts, and the creation of shell companies to launder proceeds.

Arrests and Suspects

Both Arbaz and Akthar were arrested and remanded to judicial custody. The police are investigating additional accomplices and have identified at least three other complaints linked to Arbaz. The suspects received commissions for allowing their accounts to be used in the fraud, actively aiding and abetting cybercrime networks.

Broader Implications and Trends

This case underscores the vulnerability of corporate processes to social engineering and MitM attacks, especially when verification protocols are lax. The proliferation of mule accounts, often opened with forged documents or by recruiting vulnerable individuals, is a recurring theme in Indian cybercrime. The incident also highlights the importance of immediate reporting and the role of law enforcement in tracing and freezing fraudulent transactions. Public advisories now emphasize the need for multi-factor authentication and strict verification of fund transfer requests, especially those received via informal channels like WhatsApp.