In short
A business email account or lookalike identity is used to manipulate employees into payments or sensitive actions The objective is typically to divert company money or sensitive information to the attacker.
What it is
The message appears to come from a vendor, colleague, executive or trusted business contact. The victim is then pushed to change payment details, transfer funds, send data or bypass normal approval controls.
How it starts
A business email account or lookalike identity is used to manipulate employees into payments or sensitive actions.
What they tell you
The message appears to come from a vendor, colleague, executive or trusted business contact
What they want you to do
Change payment details, transfer funds, send data or bypass normal approval controls
How you lose money
divert company money or sensitive information to the attacker
What happens next
After the first successful step, the fraudster may demand more money/information, deepen account or device access, or disappear.
Warning signs
authority | urgency | trust | secrecy | email takeover | domain spoofing | social engineering
Where this is documented
India — officially documented by an Indian authority/regulator
How to avoid it
Verify payment-detail changes and executive requests through a second trusted channel; use MFA and domain/email controls; pause unusual urgent transfers.
If it already happened
Contact the bank/payment provider immediately if money moved; report financial cyber fraud promptly via 1930 and cybercrime.gov.in; preserve messages, transaction IDs, phone numbers and URLs. Alert finance/security teams and the receiving bank immediately, and preserve email headers and approval records.