This is the reported pattern behind an alleged ₹1.64 crore email fraud involving Lulu Group, which Kochi City Police began investigating in October 2026. According to the complaint, unidentified individuals impersonated an Italian business partner and supplied fraudulent invoices and bank account details. Lulu Group reportedly transferred €150,500 to the accounts provided.
The incident raises a critical question for businesses that rely on email to manage supplier relationships and payments: What happens when someone exploits the trust built into everyday business operations?
For enterprise leaders, the answer involves more than email security. It requires examining how identities are verified, payments are approved, and suspicious transactions are detected.
Understanding Business Email Compromise
Business Email Compromise (BEC) is a form of fraud in which criminals impersonate executives, suppliers, or business partners to manipulate employees into transferring money or sharing sensitive information.
Unlike attacks that depend on malicious software, BEC can succeed through ordinary business communication. A convincing email, a believable invoice, and an altered bank account number may be enough.
In vendor impersonation schemes, criminals may use look-alike email domains or gain access to a legitimate mailbox. They can exploit information about ongoing orders, payment schedules, and supplier relationships to make fraudulent requests appear genuine.
This makes BEC particularly difficult to detect. The message may contain no malicious attachment or suspicious link. Instead, it exploits the trust employees place in familiar names, established relationships, and routine processes.
For businesses, the challenge is clear: a legitimate-looking email does not guarantee a legitimate payment request.
Five Cybersecurity Gaps Businesses Should Address
The reported case does not establish which internal controls were present or absent at Lulu Group. However, it highlights five areas other organisations should review.
1. Bank Account Changes Approved Through Email
An email should never be the sole basis for changing a supplier’s banking details.
Every change request should be verified through an independently established contact number or another trusted communication channel. Employees should never rely on contact information included in the request itself.
The verification should be documented before updated banking details are approved for payment.
2. Payment Approvals Based on Trust
Long-standing supplier relationships can create a false sense of security. Employees may be less likely to question an unusual request from a business partner they have worked with for years.
Businesses should introduce dual approval for new beneficiaries and significant changes to payment instructions. The person verifying supplier details should be separate from the person authorising the transfer.
3. Email Security That Relies Only on Spam Filters
Traditional email filters help block unwanted messages, but they cannot identify every fraudulent business request.
Organisations should configure SPF, DKIM, and DMARC to strengthen authentication for their own email domains. These measures help reduce certain spoofing risks, but they do not independently prevent look-alike domains or compromised accounts.
Additional safeguards should include suspicious domain detection, external sender warnings, multi-factor authentication, and monitoring for unusual mailbox activity.
4. Poor Coordination Between Finance and IT
Email security and payment approval are often managed by various departments. Without a shared escalation process, suspicious communication may go unnoticed until the transaction is complete.
Finance, procurement, IT, and security teams should work together to identify unusual requests and investigate potential fraud before funds are transferred.
5. Delayed Incident Response
When a fraudulent payment is discovered, the response needs to be immediate.
Employees should know how to contact the bank, preserve email and transaction records, escalate the incident internally, and report it to the appropriate authorities.
In India, suspected cyber financial fraud is reported through the national cybercrime helpline at 1930 or the National Cyber Crime Reporting Portal. Prompt reporting may improve the chances of initiating a fund freeze or recovery process, although recovery is not guaranteed.
How Businesses Can Reduce Email Fraud Risks
Preventing vendor impersonation requires a combination of technology, internal controls, and employee awareness.
Strengthen vendor verification: Establish a formal process for onboarding suppliers and changing bank details. Verify requests independently and maintain an audit trail.
Secure email and user identities: Implement multi-factor authentication, review account privileges, configure email authentication protocols, and monitor unusual sign-in activity.
Introduce risk-based payment controls: Require additional approvals for high-value transfers, new beneficiaries, international payments, and changes to existing payment instructions.
Train finance and procurement teams: Use realistic fraud scenarios to teach employees how to recognise suspicious requests, verify identities, and report concerns.
Test security controls regularly: Conduct vulnerability assessments, review access permissions, simulate incident scenarios, and evaluate whether existing procedures work under pressure.
These measures should form part of an ongoing cybersecurity programme rather than a one-time compliance exercise.
How DOT Consulting Can Help
Email impersonation is not solely an IT problem. It involves technology, financial processes, employee decisions, and organisational governance.
DOT Consulting supports businesses through cybersecurity services that include vulnerability assessment and penetration testing (VAPT), cloud hardening, business continuity planning, and virtual CISO advisory.
For organisations concerned about email fraud and payment manipulation, a structured assessment can help identify technical weaknesses, review security governance, and evaluate incident preparedness. The findings can then be translated into a prioritised remediation plan based on business risk.
DOT Consulting also supports organisations working with security frameworks and standards such as ISO 27001, SOC 2, and NIST, helping them build more consistent approaches to security and risk management.
Explore DOT Consulting’s cybersecurity services to understand how your organisation can strengthen its security posture.
Conclusion: Make Verification Part of Every Payment
The reported Lulu Group fraud shows how a routine supplier transaction can become a major financial risk when businesses trust business communication without independent verification.
Businesses cannot eliminate every impersonation attempt. They can make it considerably harder for fraudulent requests to pass through their payment processes unnoticed.
Independent verification, separation of duties, stronger email and identity controls, and a tested incident response plan provide a practical starting point.
Could your organisation identify a fraudulent supplier request before the money leaves its account?
DOT Consulting can help assess your security posture, identify priority gaps, and develop a practical plan to address them before they become costly business risks.
Frequently Asked Questions
What is Business Email Compromise (BEC)?
BEC is a type of cyber-enabled fraud in which criminals impersonate or compromise the email identity of a trusted person or organisation to manipulate payments or obtain sensitive information.
How can businesses prevent fraudulent supplier payments?
Businesses should independently verify bank detail changes, require dual approval for high-risk payments, restrict access to supplier records, and maintain clear procedures for escalating suspicious requests.
Can email fraud happen without hacking a company’s systems?
Yes. Criminals can use look-alike domains and convincing messages without accessing the victim’s network. Other schemes involve compromised email accounts. Different attack methods require different security controls.
Are SPF, DKIM, and DMARC enough to prevent email fraud?
No. These protocols help authenticate email sent using an organisation’s domain, but they cannot prevent every look-alike domain, compromised account, or fraudulent payment request. They should be combined with identity security and payment verification.
How can DOT Consulting help businesses improve cybersecurity?
DOT Consulting offers services including VAPT, cloud hardening, business continuity planning, and virtual CISO advisory. These services can help organisations assess technical exposure, strengthen security controls, and improve cybersecurity governance.
Add a Comment