In short
A business mailbox is compromised and used to impersonate a legitimate sender The objective is typically to enable payment diversion, BEC or data theft.
What it is
Recipients see messages from a trusted or lookalike business identity. The victim is then pushed to send money/data or change business processes based on the compromised message.
How it starts
A business mailbox is compromised and used to impersonate a legitimate sender.
What they tell you
Recipients see messages from a trusted or lookalike business identity
What they want you to do
Send money/data or change business processes based on the compromised message
How you lose money
enable payment diversion, BEC or data theft
What happens next
After the first successful step, the fraudster may demand more money/information, deepen account or device access, or disappear.
Warning signs
trust | urgency | authority | email takeover | account compromise
Where this is documented
India — officially documented by an Indian authority/regulator
How to avoid it
Verify payment-detail changes and executive requests through a second trusted channel; use MFA and domain/email controls; pause unusual urgent transfers.
If it already happened
Contact the bank/payment provider immediately if money moved; report financial cyber fraud promptly via 1930 and cybercrime.gov.in; preserve messages, transaction IDs, phone numbers and URLs. Alert finance/security teams and the receiving bank immediately, and preserve email headers and approval records.