--- title: "Lancer’s Dubai arm paid about US$100,000 on a fake WhatsApp order; second case in 8 weeks" summary: "Lancer Container Lines’ filings of 11 September and 6 November: ₹53 lakh and about US$100,000 paid on orders from fake WhatsApp bosses, when management learned, and the checks that stop it." url: https://www.thetechbag.com/blog/lancer-100000-fake-whatsapp-manager format: Note desk: "Security" area: "Email & phishing" region: India published: 2026-11-09 facts_checked: 2026-11-09 author: TechBag (The TechBag Journal) tags: ["Lancer Container Lines","Lancia Shipping","WhatsApp impersonation","payment diversion fraud","executive impersonation","boss scam","I4C","callback verification","dual approval","SEBI LODR Regulation 30","Capillary Technologies","Spandana Sphoorty","SG Finserve","UAE"] cover: https://www.thetechbag.com/blog/covers/lancer-100000-fake-whatsapp-manager.png --- # Lancer’s Dubai arm paid about US$100,000 on a fake WhatsApp order; second case in 8 weeks *Lancer Container Lines’ filings of 11 September and 6 November: ₹53 lakh and about US$100,000 paid on orders from fake WhatsApp bosses, when management learned, and the checks that stop it.* Note · Security · Email & phishing · By TechBag · Published 2026-11-09 · Facts checked 2026-11-09 · Canonical: https://www.thetechbag.com/blog/lancer-100000-fake-whatsapp-manager On 2 November Lancia Shipping LLC, the Dubai subsidiary of Lancer Container Lines, paid about US$100,000 to a third party’s bank account after a fraudulent WhatsApp account, posing as the subsidiary’s manager, sent payment instructions to its finance team.[1][8] It was the second such loss in 53 days. On 10 September a fake WhatsApp profile of Lancer’s managing director had instructed the company’s “Accounts Executive / Authorised Person”, and ₹53,00,000 left in two payments of ₹33,00,000 and ₹20,00,000.[2] Lancer’s filings do not connect the two. ## How a WhatsApp message becomes a bank transfer Neither filing describes a break-in. Each says staff received instructions and the company paid. In September, Lancer found transactions “not in accordance with the Company’s normal payment and authorisation processes”, and it does not say which step was missed, or how.[2] It was still examining its IT systems and communication channels then. That is the pattern in [Capillary’s €3.04m](https://www.thetechbag.com/blog/capillary-czech-arm-3-04m-euros-impostors), where KPMG described outsiders exploiting “authority, secrecy, urgency, non-standard channels” to “induce authorized payment activity”.[3] It differs from [Spandana Sphoorty](https://www.thetechbag.com/blog/spandana-sphoorty-7-80-crore-cyber-fraud) (₹7.80 crore) and SG Finserve (₹5.10 crore), which filed the same week, on 2 and 3 November: their filings describe debits made without authorisation.[4][5] These cases are unconnected. It differs too from the “Boss Scam” the Home Ministry’s cybercrime centre warned of on 7 August, which hijacks a real WhatsApp account through a malicious file.[6] Lancer’s filings describe a fraudulent account or profile, and mention no hijacked one. **Figure: Management learned of the first fake order the next day, and of the second four days on** *Lancer's two WhatsApp impersonation losses, 10 September to 6 November 2026; times are IST* | Date | Event | Detail | | --- | --- | --- | | 10 Sept 2026 | Fake MD: ₹53 lakh paid | Two payments to third-party accounts | | 11 Sept 2026 | Management learns, about noon | One day later | | 11 Sept 2026 | Filed with BSE, 7:28pm | Complaint and e-Zero FIR the same day | | 2 Nov 2026 | Fake manager: US$100,000 paid | Dubai subsidiary | | 6 Nov 2026 | Management learns, about noon | Four days later | | 6 Nov 2026 | Filed with NSE, 8:33pm | Complaint with UAE authorities | Source: Lancer Container Lines filings; NSE and BSE announcement records · as of 9 November 2026 ## Why a loss this size reaches the exchanges Events in Para A of Schedule III to SEBI’s listing rules are disclosed “without any application of the guidelines for materiality”, and its fraud paragraph reaches a subsidiary, “whether occurred within India or abroad”. Lancer cites Part A. Regulation 30(6) allows 12 hours for an event arising inside the company and 24 for one that does not, counted “from the occurrence of the event or information”; a late filing must explain the delay.[7] Lancer filed about seven and a half hours after the noon it gives in September, and eight and a half in November. Neither filing includes a delay explanation or says which moment Lancer counted from, and we draw no conclusion on compliance. For any listed group the practical point is escalation: the regulation’s words are “from the occurrence”, and a subsidiary’s payment can be days old before head office hears of it. TechBag countHow large, against the quarter Lancer’s consolidated profit before exceptional items and tax for July to September was ₹7.76 crore.[8] The ₹53 lakh, booked as an exceptional item, is 6.8% of that. At ₹93.92 to the dollar[9] US$100,000 is about ₹93.9 lakh, or 12.1%, though it falls in the next quarter. Both before any recovery. ## The two checks, and what is still open KPMG’s advice after Capillary names both: independent verification of payment requests that arrive through “caller identification, profile images, or messaging platforms”, and a review of callback and approval steps for new counterparties.[3] In practice: call back on a number you already hold, and require a second approver for any new beneficiary. A WhatsApp name and photo prove nothing, and an email filter never sees the message. Still open: the bank, whether any of the US$100,000 is recovered, and whether the checks existed at Lancia. In September Lancer said “strengthening measures” were under way.[2] Its results say police froze the September fraudsters’ account and the money in it will be refunded, without saying how much.[8] How we did this Figures as of 9 November 2026, 7pm IST Incident facts are Lancer’s own filings; the manager is named there and not here. Filing times are the exchanges’ records. The September filing went to BSE alone; the shares joined NSE on 14 October. The 53 days, hours, percentages and rupee conversion are our arithmetic. Not used: any account of how the fake accounts were made, or why the two cases happened, which the filings do not give. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [Lancer Container Lines, Regulation 30: Reporting of Cyber Fraud (Lancia Shipping LLC), NSE](https://nsearchives.nseindia.com/corporate/LANCER_06112026203246_CyberfraudLancia.pdf) — 6 November 2026 2. [Lancer Container Lines, Regulation 30: Reporting of Cyber Fraud, BSE](https://www.bseindia.com/xml-data/corpfiling/AttachHis/c03b91dc-5691-4803-9efd-287b36d17f6b.pdf) — 11 September 2026 3. [Capillary Technologies, KPMG forensic summary (Annexure A), NSE](https://nsearchives.nseindia.com/corporate/CAPILLARY12_31102026083756_Intimation_Forensic_Audit_Report.pdf) — 31 October 2026 4. [Spandana Sphoorty Financial, Regulation 30: Cyber Fraud Incident, NSE](https://nsearchives.nseindia.com/corporate/SPANDANA_02112026105300_SEcyberfraud.pdf) — 2 November 2026 5. [SG Finserve, Regulation 30 intimation, NSE](https://nsearchives.nseindia.com/corporate/SGFINSERVE_03112026181926_Toupload.pdf) — 3 November 2026 6. [News On AIR, I4C cautions corporates against Boss Scam](https://newsonair.gov.in/i4c-cautions-corporates-and-finance-professionals-against-boss-scam/) — 7 August 2026 7. [SEBI, LODR Regulations 2015, amended to 22 January 2026: regulation 30(6), Schedule III Part A Para A(6)](https://www.sebi.gov.in/sebi_data/attachdocs/jun-2026/1780915347745.pdf) — 22 January 2026 8. [Lancer Container Lines, results for the quarter to 30 September 2026 (note 4), NSE](https://nsearchives.nseindia.com/corporate/LANCER_06112026200130_06112026OutcomeofBM.pdf) — 6 November 2026 9. [European Central Bank reference rates, USD/INR cross rate (Frankfurter API)](https://api.frankfurter.app/2026-11-06?from=USD&to=INR) — 6 November 2026 **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. **Read this next:** [3,897 SBI records leaked. Three clocks now run: 6 hours, 6 hours and 72 hours](https://www.thetechbag.com/blog/sbi-leak-three-clocks-six-hours-72-hours) — The clocks a disclosure runs on: SBI’s leak set a 72-hour Rule 7 window beside six-hour reports to CERT-In and the RBI. Go deeper on TechBag - [Email security guide](https://www.thetechbag.com/browse/security/email-security) — what email filters catch, and why a WhatsApp order never reaches them - [Abnormal Inbound Email Security](https://www.thetechbag.com/abnormal/abnormal-inbound-email) — a filter built around impersonation and payment-request fraud, for the same trick when it arrives by email