Lancer’s Dubai arm paid about US$100,000 on a fake WhatsApp order; second case in 8 weeks
Lancer Container Lines’ filings of 11 September and 6 November: ₹53 lakh and about US$100,000 paid on orders from fake WhatsApp bosses, when management learned, and the checks that stop it.
On 2 November Lancia Shipping LLC, the Dubai subsidiary of Lancer Container Lines, paid about US$100,000 to a third party’s bank account after a fraudulent WhatsApp account, posing as the subsidiary’s manager, sent payment instructions to its finance team.18 It was the second such loss in 53 days. On 10 September a fake WhatsApp profile of Lancer’s managing director had instructed the company’s “Accounts Executive / Authorised Person”, and ₹53,00,000 left in two payments of ₹33,00,000 and ₹20,00,000.2 Lancer’s filings do not connect the two.
01How a WhatsApp message becomes a bank transfer
Neither filing describes a break-in. Each says staff received instructions and the company paid. In September, Lancer found transactions “not in accordance with the Company’s normal payment and authorisation processes”, and it does not say which step was missed, or how.2 It was still examining its IT systems and communication channels then.
That is the pattern in Capillary’s €3.04m, where KPMG described outsiders exploiting “authority, secrecy, urgency, non-standard channels” to “induce authorized payment activity”.3 It differs from Spandana Sphoorty (₹7.80 crore) and SG Finserve (₹5.10 crore), which filed the same week, on 2 and 3 November: their filings describe debits made without authorisation.45 These cases are unconnected. It differs too from the “Boss Scam” the Home Ministry’s cybercrime centre warned of on 7 August, which hijacks a real WhatsApp account through a malicious file.6 Lancer’s filings describe a fraudulent account or profile, and mention no hijacked one.
Management learned of the first fake order the next day, and of the second four days on
Lancer's two WhatsApp impersonation losses, 10 September to 6 November 2026; times are IST
Show tableHide table
| Date | Event | Detail |
|---|---|---|
| 10 Sept 2026 | Fake MD: ₹53 lakh paid | Two payments to third-party accounts |
| 11 Sept 2026 | Management learns, about noon | One day later |
| 11 Sept 2026 | Filed with BSE, 7:28pm | Complaint and e-Zero FIR the same day |
| 2 Nov 2026 | Fake manager: US$100,000 paid | Dubai subsidiary |
| 6 Nov 2026 | Management learns, about noon | Four days later |
| 6 Nov 2026 | Filed with NSE, 8:33pm | Complaint with UAE authorities |
Source: Lancer Container Lines filings; NSE and BSE announcement records · as of 9 November 2026
02Why a loss this size reaches the exchanges
Events in Para A of Schedule III to SEBI’s listing rules are disclosed “without any application of the guidelines for materiality”, and its fraud paragraph reaches a subsidiary, “whether occurred within India or abroad”. Lancer cites Part A. Regulation 30(6) allows 12 hours for an event arising inside the company and 24 for one that does not, counted “from the occurrence of the event or information”; a late filing must explain the delay.7
Lancer filed about seven and a half hours after the noon it gives in September, and eight and a half in November. Neither filing includes a delay explanation or says which moment Lancer counted from, and we draw no conclusion on compliance. For any listed group the practical point is escalation: the regulation’s words are “from the occurrence”, and a subsidiary’s payment can be days old before head office hears of it.
03The two checks, and what is still open
KPMG’s advice after Capillary names both: independent verification of payment requests that arrive through “caller identification, profile images, or messaging platforms”, and a review of callback and approval steps for new counterparties.3 In practice: call back on a number you already hold, and require a second approver for any new beneficiary. A WhatsApp name and photo prove nothing, and an email filter never sees the message.
Still open: the bank, whether any of the US$100,000 is recovered, and whether the checks existed at Lancia. In September Lancer said “strengthening measures” were under way.2 Its results say police froze the September fraudsters’ account and the money in it will be refunded, without saying how much.8
Sources
- Lancer Container Lines, Regulation 30: Reporting of Cyber Fraud (Lancia Shipping LLC), NSE — 6 November 2026
- Lancer Container Lines, Regulation 30: Reporting of Cyber Fraud, BSE — 11 September 2026
- Capillary Technologies, KPMG forensic summary (Annexure A), NSE — 31 October 2026
- Spandana Sphoorty Financial, Regulation 30: Cyber Fraud Incident, NSE — 2 November 2026
- SG Finserve, Regulation 30 intimation, NSE — 3 November 2026
- News On AIR, I4C cautions corporates against Boss Scam — 7 August 2026
- SEBI, LODR Regulations 2015, amended to 22 January 2026: regulation 30(6), Schedule III Part A Para A(6) — 22 January 2026
- Lancer Container Lines, results for the quarter to 30 September 2026 (note 4), NSE — 6 November 2026
- European Central Bank reference rates, USD/INR cross rate (Frankfurter API) — 6 November 2026
Disclosure. TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.
Keep reading
