Stops payment requests that only claim to come from the boss
TL;DR Bossproof sits between a company's senior people and its accounts team. It learns how each executive really writes and what they normally ask for, flags payment requests on email or chat apps that don't fit, and holds them until someone confirms by phone. Mid-sized Indian companies pay a monthly subscription.
In June 2026, India's cybercrime coordination centre warned companies about the "boss scam"[1]. Attackers send a ZIP file posing as an RBI notice, take over an executive's chat-app web session and then message the accounts team asking for urgent transfers. One Mumbai deputy general manager made 63 transfers worth about ₹10.4 Cr in under two weeks. An Ahmedabad accountant was asked for ₹1.5 Cr by a profile using his employer's photo[2].
Email is still in play too[1]. In Pune, an employee is accused of using fake CEO emails, among other tricks, to move about ₹2.45 Cr over 20 months while finance paid without checking[3]. The failure is the same every time - the accounts team trusts the sender's name.
Bossproof connects to the company's mail system and to a business messaging number the accounts team uses for approvals. For each senior person it builds a profile of how they write and ask, covering the usual greeting, length, language mix, time of day and the kinds of payment they request and to whom. When a message asks for money and breaks that pattern, or comes from a new number or a lookalike address, Bossproof marks it and tells the accounts person to call the executive on a number already on file.
The second half is process and not detection. Payments above a set amount need a call-back logged in Bossproof before the bank upload, whatever the score says.
The seed proposed behavioural biometrics in the inbox, and I reframed it. Typing and mouse rhythm come from a device you control, and an inbound email carries none of that. Writing and request patterns, plus a forced call-back, catch the same fraud with data the company already has. Vendor bank-detail changes are a separate problem covered under a different idea.
The CFO pays, often right after a near miss. The users are accounts executives and the executives being impersonated. A monthly fee by number of protected executives suits companies with ₹50–500 Cr revenue, so test whether ₹5,000–15,000 a month per company lands. CA firms that already audit these companies are a natural referral route.
The national advisory came on 22 June 2026, with headline cases following within weeks[2]. Attackers have moved from email to chat-app web sessions, which most email security tools never see. Language models also make fake messages fluent, so spelling mistakes don't give them away any more.
I couldn't find a national total for CEO-impersonation losses in India. Reported cases run from ₹1.5 Cr to about ₹10.4 Cr each[2][3]. The narrow buyer is a mid-sized company where one or two people can release big payments on a message. There's no count of such companies that I found, so start with a list built from your own network.
One US email-security vendor sells behaviour-based protection with business email compromise and impersonation as a named use case[4]. The big mail suites offer impersonation warnings too. None of them sees chat messages to the accounts team, and none forces a call-back step before payment.
In India, most mid-sized firms rely on a policy document that staff forget the moment they're under pressure.
| Difficulty | Moderate (36/100) |
| Starting capital | ₹60 L–1.2 Cr |
| Time to launch | 6–9 months |
Mail integration is standard. Chat apps are harder, because you can only see messages that reach a business number you control, so the company has to route approvals there. Getting senior people to accept a call-back on their own requests is the cultural hurdle.
No licence is needed for Bossproof itself. What matters is how you read staff messages and what you do after a fraud.
Keep an eye on government advisories about impersonation scams too, since they change what clients ask for[1].
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
Don't let AI clear a payment. A clean score is not approval, which is why the call-back for large amounts stays mandatory whatever the model says.
Want to work out the AI layer for Bossproof? Talk to Yash →
I think this is a reasonable bet for a founder who has sold to finance teams and gets how payment approvals work. As a pure detection play it's weak. Prove first that five companies will route every payment request through one checked channel for a month.
Roughly ₹60 L–1.2 Cr, mainly for engineers who can connect mail systems and business messaging, plus sales time with finance heads.
No licence for the product itself. You need company registration, GST once over the threshold, DPDP compliance and a plan for CERT-In incident reporting.
Yes. Boss scams are global, so the call-back process travels well. Check local rules on scanning staff messages before you sell.
The free Bossproof validation kit has the line-by-line capital breakdown, the effort scoring, the data-protection checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for CFOs and accounts teams, and 5 assumptions to test. Download the kit →
Thinking about building Bossproof or something close to it? The make-or-break work is getting every payment request into a channel you can check, and I'm happy to help you figure out how to sell that to a CFO. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.