In short
An employee/business mailbox is compromised through phishing, credential reuse or social engineering The objective is typically to enable BEC, invoice diversion, data theft or broader account compromise.
What it is
The attacker uses the legitimate mailbox to observe conversations and impersonate the account holder. The victim is then pushed to approve/respond to fraudulent payment, credential or data requests sent from the compromised account.
How it starts
An employee/business mailbox is compromised through phishing, credential reuse or social engineering.
What they tell you
The attacker uses the legitimate mailbox to observe conversations and impersonate the account holder
What they want you to do
Approve/respond to fraudulent payment, credential or data requests sent from the compromised account
How you lose money
enable BEC, invoice diversion, data theft or broader account compromise
What happens next
After the first successful step, the fraudster may demand more money/information, deepen account or device access, or disappear.
Warning signs
trust | routine | urgency | account takeover | credential stuffing | phishing
Where this is documented
India — officially documented by an Indian authority/regulator
How to avoid it
Verify payment-detail changes and executive requests through a second trusted channel; use MFA and domain/email controls; pause unusual urgent transfers.
If it already happened
Contact the bank/payment provider immediately if money moved; report financial cyber fraud promptly via 1930 and cybercrime.gov.in; preserve messages, transaction IDs, phone numbers and URLs. Alert finance/security teams and the receiving bank immediately, and preserve email headers and approval records.