A WhatsApp impersonation fraud in Ahmedabad, Gujarat on 18 August 2025 saw a pharmaceutical company accountant transfer ₹3 crore from his employer's corporate bank account to fraudsters who posed as his superior. In a swift joint response, the Ahmedabad Rural Police managed to freeze ₹2.94 crore within four to five hours of the fraud being reported, according to police.

How the Fraud Unfolded

Hardik Patel, an accountant at Pure and Cure — a pharmaceutical company operating in the Changodar police station limits — received WhatsApp messages one morning from an unknown number. The account used his boss's photograph, profile details, and reportedly mimicked the communication style of his actual superior.

'The number was unknown, but the WhatsApp display picture and the profile details were exactly similar to those of his boss. The way of speaking and the language used were also similar, because of which Hardikbhai believed that he was speaking to his boss,' said Deputy Superintendent of Police (DySP) Tapansinh Dodia.

The impersonator directed Patel to execute a financial transfer of ₹3 crore. Patel, treating it as a routine high-value transaction — the company regularly procures raw APIs and pharmaceutical raw materials through such payments — complied. It was only after the transfer was completed, when Patel called his actual boss to confirm, that he realised he had been deceived.

Police Response and Fund Recovery

Patel immediately alerted the police, following which the Changodar police station and the LCB Cyber Cell launched a coordinated response. The accounts involved in the transaction were frozen the same day. According to DySP Dodia, the quick action was possible because both units acted jointly upon receiving information about the transaction.

Of the ₹2.94 crore frozen, ₹2.88 crore has since been returned to the complainant through a court order. The remaining ₹6 lakh is still pending in an SBI account due to the bank's internal processing procedure, according to police. Dodia confirmed that recovery efforts for the outstanding amount are ongoing.

The Money Trail: From Gujarat to Andhra Pradesh and Beyond

Investigators traced the initial ₹3 crore to a primary account in Guntur district, Andhra Pradesh, registered to a person identified as Gokul Guruwardhan. From that account, two transactions of ₹6 lakh each — totalling ₹12 lakh — were routed to two further accounts: one in Madhya Pradesh belonging to a person named Updesh Yadav, and another in Jammu and Kashmir.

Police are now investigating whether the Guntur account was a 'mule account' — a third-party account used by fraudsters to launder proceeds — or whether the account holder himself was directly involved. 'This angle is under investigation. Our team has gone to another state to investigate. Only after obtaining detailed information about the account can it be established whether it is a mule account or whether the account holder himself is an accused,' Dodia said.

Why the Accountant Did Not Suspect the Transfer

A key question in the case is why a ₹3 crore transfer did not immediately raise red flags. DySP Dodia explained that Pure and Cure routinely handles large-value transactions for procurement of raw APIs and pharmaceutical raw materials. 'Generally, the company procures raw APIs and raw materials, and such large transactions through Hardikbhai take place in the normal course of their business. Therefore, it did not appear suspicious to him that such a large transaction was being made. The account was also a corporate account, so a transaction of ₹3 crore could take place at one go,' he said.

This context is critical: cyber fraudsters increasingly target employees at companies with high-value transaction norms, precisely because the threshold for suspicion is higher. This is consistent with a broader national pattern of WhatsApp-based CEO fraud, also known as business email compromise adapted for messaging platforms.

Investigation Status and What Comes Next

Police have dispatched a team to the state where Gokul Guruwardhan is based to examine his banking history and transaction records in detail. Dodia said investigators will assess whether large sums had previously moved through the account and whether the transactions show suspicious patterns. The identity and extent of involvement of all account holders will be established only after a thorough review of their financial records, he added.

The remaining ₹6 lakh is expected to be returned to Pure and Cure once SBI completes its internal procedures. The case underscores the urgent need for corporate verification protocols before executing large transfers — even when the instruction appears to come from a known superior.