Someone has set up a WhatsApp account with your CEO's name and photo. Or a LinkedIn profile that copies your founder, title, company, even the headshot. Your finance team just got a message from "the boss" asking for an urgent transfer, and nobody is sure if it is real. This is the boss scam, and in 2026 it is one of the fastest-moving frauds hitting Indian companies. Executive impersonation removal in India is part takedown and part damage control, which is why it sits alongside our reputation repair work. The impersonation is not the goal. It is the delivery vehicle for a wire fraud, a data leak, or a supplier switch.
If you are the CFO, the founder, or the person who runs comms, you are dealing with two problems at once. You need the fake account taken down, and you need to stop money from leaving before it does. This guide covers both, in the order that actually matters, with the Indian reporting routes and the legal levers that apply.
Quick answer: how to handle executive impersonation in India
Executive impersonation removal in India starts with containment, not the takedown. Freeze any pending payment, warn staff the "CEO" account is fake, and preserve evidence. Report the fake WhatsApp or LinkedIn profile in-app, and if money moved, call 1930 and file at cybercrime.gov.in. Takedown speed depends on the platform.
What executive impersonation looks like in 2026
Executive impersonation is when a fraudster poses as a senior person at your company to trick staff, vendors, or customers. The target is usually the finance function. The playbook is simple and it works.
A fraudster creates a WhatsApp account using your CEO's name and profile picture, often pulled from LinkedIn or a press photo. The number is new and unknown. The message reads like the boss: short, urgent, a little secretive. "In a meeting, cannot talk, need you to process a payment to this account today." A junior finance staffer, wanting to be responsive, pays.
There is a more technical version too. In its June 2026 advisory, the Indian Cyber Crime Coordination Centre (I4C) under the Ministry of Home Affairs warned of "regulatory and executive impersonation for WhatsApp account takeover." Fraudsters send a compressed file over WhatsApp, SMS, or email, named like a routine document, for example "Statement of Account.zip" or files posing as RBI or MCA notices. Opened on a Windows machine, the file installs malware that hijacks the victim's WhatsApp Web session. Now the criminal is messaging the finance team from the executive's real account. That is much harder to spot.
You can read the government's warning on the Press Information Bureau site.
If money has already moved, report it at cybercrime.gov.in and call the 1930 cyber-fraud helpline.
LinkedIn is the reconnaissance layer and a second attack surface. A fake LinkedIn profile using your executive's name lets a fraudster connect with your staff, learn the org chart, and warm up a target before the WhatsApp move. Sometimes the fake profile itself does the asking.
This is a business problem, but it is also a personal reputation problem for the executive whose face is on the fraud. That is where reputation work and fraud response meet. Our online reputation management practice sits at exactly that intersection.
Contain the fraud first, then chase the takedown
Here is the one opinion this guide will push hard. What most people get wrong is treating impersonation as an IT ticket or a "please remove this profile" request. It is a live financial-fraud event first and a reputation event second. If you spend the first hour drafting a takedown request while a payment is clearing, you have solved the wrong problem.
Containment, in order:
- Freeze pending payments. Tell accounts and treasury to hold every transfer that traces back to a "CEO" instruction on chat or email until it is verified by voice or in person. The I4C advisory says the same thing: verify instructions through a direct call or face-to-face, never through the same channel that sent them.
- Kill the trust of the fake channel. Send one internal message from a known, verified account: "A WhatsApp or LinkedIn account is impersonating [name]. Do not act on payment or data requests from it. Verify with me directly." Contain the scam by removing its authority, fast.
- Check whether a real account was taken over. If the messages come from the executive's genuine number, treat it as account compromise. Have them log out of all WhatsApp linked devices and secure the account before anything else.
- Then, and only then, start the takedown.
If money already moved, the clock is unforgiving. Call 1930, the national cybercrime financial-fraud helpline run by I4C, and file at cybercrime.gov.in. The sooner a complaint enters the system, the sooner banks can try to freeze the funds in the mule account. Reporting inside the first hour gives the best chance of a hold. Nobody can promise recovery, but early reporting is the single biggest factor you control.
Preserve evidence before you report
Reporting deletes context. Blocking hides the chat. Do the evidence step first, because you cannot get it back.
Capture, for each fake account:
- Full-screen screenshots of the profile: the name, the photo, the phone number or profile URL, the "about" text, and the join or "member since" detail if shown.
- Screenshots of the messages, with timestamps visible, and the exact account or vendor details the fraudster asked money to be sent to.
- The URL of the fake LinkedIn profile and, for WhatsApp, the exact phone number in international format.
- Any email headers if the impersonation also came by email. Headers carry the sending path, which investigators use.
- A short written timeline: who received what, when, and what action was taken. This becomes the backbone of your police complaint.
Store all of it in one folder, ideally exported and shared with your legal and security leads. If this ever becomes a First Information Report or a platform legal escalation, clean evidence is what moves it forward. For the reputation cleanup that follows, the same file feeds our reputation repair work.
How to report a fake WhatsApp account using your company name
WhatsApp does not publish a company impersonation form the way some platforms do, so you work through its in-app reporting and its help articles. WhatsApp's guidance on what to do when someone is pretending to be you is the reference to follow.
Practical steps:
- Open the chat with the impersonating account. Use the in-app option to report it. When you report an account, WhatsApp receives the last several messages from that chat. The reported account is not notified.
- Block the account after you have captured evidence, so it can no longer reach the person it messaged.
- If the executive's own account was hijacked, use WhatsApp's account-recovery flow: register the number again with the SMS code to log the attacker out, then re-secure it and turn on two-step verification.
- Report the number to 1930 and cybercrime.gov.in if it was used to attempt or commit financial fraud.
Be realistic about what WhatsApp reporting does. It can lead to the fake account being actioned, but there is no guaranteed outcome and no fixed timeline. A number is cheap. A determined fraudster registers another and starts again. That is not a reason to skip reporting. It is a reason to pair it with monitoring, which we cover below.
How to report a fake LinkedIn profile impersonating your executive
LinkedIn has a dedicated impersonation route, and it is more structured than WhatsApp's. Its help article on how to report fake profiles walks through it.
On the fake profile:
- Click the "More" button below the profile picture, then choose "Report or block."
- Select the option to report the person or the entire account.
- Choose "This person is impersonating someone," then submit the report.
- If the impersonated executive has their own LinkedIn account, they should report from their logged-in session, which strengthens the signal.
- If the executive's real LinkedIn account was hijacked rather than copied, use LinkedIn's compromised-account report route instead.
LinkedIn tends to act on clear impersonation of a real, identifiable person, especially when the real person reports it. Keep the evidence file updated with the report reference. As with WhatsApp, removal is likely on a strong report but not certain, and re-creation can happen.
The India legal levers behind a takedown
Platform reporting is the fast lane. The law is the heavier lane, and it matters when the fraud caused loss or when a platform will not act without a legal basis. This is general information, not legal advice.
- IT Act, Section 66C (identity theft). Fraudulent or dishonest use of another person's identifying feature, such as a photo, name, or password, can fall here. Using an executive's name and photo to deceive staff is the classic fact pattern.
- IT Act, Section 66D (cheating by personation using a computer resource). Cheating someone by pretending to be another person through a computer or communication device is squarely aimed at the boss scam.
- Bharatiya Nyaya Sanhita (BNS) 2023. The BNS, which replaced the old IPC, carries the current provisions on cheating, cheating by personation, and forgery that a fraud complaint typically cites alongside the IT Act. Your lawyer will map the exact sections to the facts.
- IT Rules 2021, grievance officer route. Intermediaries operating in India must have a grievance officer and act on valid complaints within set timelines. A formal legal notice to the platform's grievance officer, drafted by counsel, can escalate a takedown beyond the in-app report.
- DPDP Act 2023, correction and erasure. Where the impersonation involves misuse of the executive's personal data, the correction and erasure provisions may support a request to a data fiduciary. This is emerging and case-by-case, not a guaranteed erasure button.
A police complaint through cybercrime.gov.in or a local cyber cell does two things at once. It starts the financial-recovery process, and it creates the official record a platform or a court may ask for. If you want removal of related fraud pages or scam listings from search results later, that record also supports our remove from Google work, which distinguishes removing a source from suppressing a result.
What is realistically possible: takedown depends on the platform
Here is the honest limitation this guide owes you. No agency, law firm, or ORM company can guarantee that a fake account comes down, or promise a fixed timeline for it. Takedown depends on the platform's own review, its policies, and how clearly the impersonation is proven. WhatsApp and LinkedIn each decide on their own terms.
Two things follow from that.
First, deletion and suppression are different outcomes, and you should know which one you are getting. Deletion is the platform removing the fake account. Suppression is pushing down the wrong or damaging results about the executive so that customers and staff meet the real story first. You often need both. When a fake profile keeps reappearing, suppression of the executive's genuine, verified footprint is what holds the line between takedowns.
Second, a determined fraudster re-creates accounts. You take one down on Monday, another appears on Thursday with a slightly different handle. This is why monitoring matters more than any single removal. Set up alerts for the executive's name and the company name across platforms and search, so a new fake account is caught in days, not after it has already messaged your vendors. That ongoing watch is the difference between a one-time cleanup and actual protection.
If you want a second set of eyes on the pattern before you commit spend, a calm assessment beats a panic purchase. Ask us for a free ORM report and we will tell you honestly what is takedown, what is suppression, and what is monitoring.
Corporate versus individual impersonation: two different problems
It helps to name what this is not. A fake Instagram account copying a private individual is a different problem with a different audience and a different fix. That is a personal-account issue, and we cover it separately in our guide to Instagram impersonation and fake account removal in India.
Executive and brand impersonation on WhatsApp and LinkedIn is a B2B problem. The audience is your own staff, your vendors, and your customers. The damage vector is financial and contractual, not just embarrassment. The response involves your finance controls, your legal team, and your comms function, not only a report button. Treat the two as siblings, not twins.
How this shows up in AI search and why it matters
More people now ask an AI assistant before they ask a search engine. Someone at your company, or a worried vendor, may type into ChatGPT, Perplexity, or Google's AI answers: "Is [executive name] at [company] contacting people on WhatsApp for payments?" or "How do I know if a LinkedIn profile of [CEO] is fake?"
What the AI says depends on what it can read about your executive and your company. If the honest, verified information is thin, the AI fills the gap with whatever it finds, including scam reports and forum threads. If your executive's real profiles, your company's fraud-awareness note, and clear verification guidance are well-published, the AI is far more likely to surface the truth and even warn the reader that impersonation exists.
Executive impersonation is a case where AI-search reputation is a defensive asset. A clear, public statement of how your company will and will not contact people about payments, indexed and consistent across your site and the executive's verified profiles, becomes a fact the AI can cite back to a nervous reader. That is reputation work doing fraud-prevention work. Our reputation repair approach builds exactly that verified layer.
An anonymized example from the field
A mid-sized manufacturer's finance associate received WhatsApp messages from an account showing the managing director's name and photo, asking to rush a payment to a "new supplier" before day's end. The number was unfamiliar, but the tone was right and the pressure was real.
The associate paused and called the managing director directly, who knew nothing about it. From there the company did the right things in the right order. Finance froze the payment. A verified all-staff message went out naming the fake account and telling everyone to ignore it. The team screenshotted the profile, the messages, and the requested bank details before reporting the WhatsApp account and filing on the cybercrime portal. Because a real account had not been compromised, the fix was containment plus reporting, plus a monitoring watch for the name.
No money left the company. The account that did the impersonating went quiet, and a look-alike appeared weeks later, which the monitoring caught early. That is the realistic shape of a good outcome. Not a dramatic single takedown, but a fast containment, a clean report, and a watch that keeps catching the re-creations. We share the pattern, not the client, and we invent no numbers.
Your executive impersonation response, on one page
For the CFO or founder who wants the short version:
- Contain money and trust first. Freeze suspicious payments. Warn staff the "CEO" account is fake.
- Preserve evidence before you report. Screenshots, numbers, URLs, timeline.
- Report in-app: the fake WhatsApp account and the fake LinkedIn profile.
- If money moved, call 1930 and file at cybercrime.gov.in in the first hour.
- Add legal weight where needed: IT Act 66C and 66D, BNS, and a grievance-officer notice through counsel.
- Expect takedown to depend on the platform. Pair every removal with monitoring, because re-creation happens.
- Rebuild the executive's verified footprint so the truth ranks and AI answers cite it.
More reputation playbooks like this one live on the FameNinja blog.
A calm close
An impersonated executive account is frightening because it moves fast and it uses your own people's helpfulness against them. The good news is that the response is knowable. Contain, preserve, report, escalate, and monitor, in that order, and you take back control of a situation that was designed to make you panic.
If you want an honest read on your specific case, whether it is a single fake WhatsApp number or a pattern of look-alike LinkedIn profiles, we are happy to help you think it through. Request a free ORM report. We will tell you what is removable, what is suppressible, and what needs watching, without overpromising a single takedown.