Lulu Group, the multinational retail and shopping mall operator headed by the businessman M. A. Yusuff Ali, has lost ₹1.64 crore as a result of email impersonation fraud, the Kochi City Cyber Crime Police said.
In that incident, fraudsters in the company impersonated representatives of a long-standing business to force the company to pay up an armload of money in the name of making money to them, a crime which is being investigated by the Kochi City Cyber Crime Police under the name of cyber crime in which people fraudulently impersonate company representatives and send payments to unauthorised bank accounts.
Lawyer Deepak Sreedhar Nair, legal manager at Lulu Group, said the fraudsters presented themselves as IE Park S R L, a company that had long been in business with Lulu Group.
The fraudsters would have created email accounts similar to those being sent by the real business partner and used them to chat with Lulu Group employees.
The fraudsters are believed to have persuaded the company that the payment instructions came from an authorised source through the fake emails and bank accounts that had been issued to purchase gaming equipment, he said.
Lulu Group was sure that the messages were genuine and transferred €150,500, which was about ₹1.64 crore. The alleged fraud seems to have owed to the trust that is usually part of a supplier relationship.
In business transactions of large size, companies send invoices, purchase information, delivery information and banking instructions in an email. With these systems, criminals can take advantage of having addresses that look like genuine corporate email addresses, changing payment information or impersonating authorised representatives.
Even small differences in an email address can go unnoticed when employees are negotiating multiple transactions under time pressure.
This incident has led the Kochi City Cyber Crime Police to investigate. An FIR has been registered at Cyber Crime Police Station according to the Bharatiya Nyaya Sanhita (BNS) and Information Technology Act.
Investigation will focus on email communication, payment instructions, transaction records and bank account information for the alleged fraud. The investigators will look at how the impersonation was carried out, who received the money and whether the operation was conducted by more than one person or by more than one account. We have not found out the name of the alleged perpetrators and the end destination of the money.
This case also illustrates how business email compromise can affect even large companies with well-established financial and administrative systems. Unlike traditional cyberattacks that might involve malicious software or hacking into the computer network to impersonate a recipient, email impersonation scams can work by manipulating employees to do what they think is correct.
Fraudsters may have studied supplier relationships, carried out the same communication style and passed on fake invoices to boost the probability of a payment being accepted. In some cases, they are able to break into a real email account, and in others they create an email address that is only a few characters different. The police are still investigating the Lulu Group case.
Lulu Group has a major international presence, particularly in the Middle East, and operates hypermarkets and shopping malls in a variety of countries like India.
Under the leadership of M. A. Yusuff Ali, the company has expanded to a wide range of business activities, including retail, imports and distribution, trading, shipping and information technology. Its large scale operations involve suppliers, service providers and financial transactions across different markets.
The alleged loss therefore underlines the need for very strong checks in corporate payment systems when dealing with established vendors and overseas business partners.
Companies in general are advised by cybersecurity experts to verify supplier bank details by an independent phone number or through another trusted communication channel.
Businesses can also use the same approval for high value transfers, train employees to spot suspicious email names or email authentication and monitoring systems to prevent impersonation.
Workers should be on guard against sudden requests to change payment instructions, even if the message is from someone you know. If a suspicious transfer is suspected, quickly contacting the bank and reporting the incident to the cybercrime authorities will help to trace or freeze the money in question.
The investigation into the alleged ₹1.64 crore fraud is ongoing, and police are still trying to find out what else is there, but the case should serve as a sign that email-based financial scams are an inherent threat to companies of all sizes.
The Lulu Group’s fraud was an eye-opener for me but I am very much more interested in the lesson I take from it as well: payment verification, secure business communications and reporting immediately when a financial transaction appears suspicious.
Comments