Retail major Lulu Group has suffered a financial loss of approximately Rs 1.64 crore after falling victim to an email impersonation fraud orchestrated by unidentified cybercriminals. According to a First Information Report registered by the Kochi City Police, the perpetrators impersonated representatives of IE Park SRL, an Italian firm that has maintained an established business relationship with the multinational conglomerate. Operating through fabricated email addresses crafted to resemble those of the overseas partner, the fraudsters submitted forged invoices and altered bank account details to solicit payments for commercial transactions. Convinced of the authenticity of the communications, the retail network authorized the transfer of 150,500 euros, only discovering the deception after the funds had been credited to criminal accounts.
Deceptive Invoices for Gaming Equipment Trigger Fund Transfers
The fraudulent operation unfolded over a four-week span between September 2 and 29, 2026. Official police records indicate that the accused targeted staff members handling commercial disbursements by demanding the settlement of outstanding dues linked to the acquisition of commercial gaming equipment. The electronic communications simulated legitimate vendor correspondence with high accuracy, leading the retail group to process the transactions through standard administrative channels. By omitting independent checks of the new bank coordinates, the company executed transfers amounting to 150,500 euros directly into recipient accounts managed by the perpetrators.
Such business email compromise schemes rely on subtle modifications to authentic domain names or the creation of lookalike sender addresses. When financial teams handle large volumes of corporate correspondence, minor variations in email strings can easily escape visual detection. Investigators are analyzing the digital chain of events to establish how the perpetrators obtained prior knowledge of the commercial dealings and pending equipment orders shared between Lulu Group and the Italian supplier, which enabled the criminals to make their requests appear fully authentic.
Cyber Crime Police Register FIR Under Statutory Provisions
Kochi City Police officially registered the case on Friday at the Cyber Crime Police Station following a detailed complaint submitted by Deepak Sreedhar Nair, legal manager at Lulu Group. The police initiated the case under applicable provisions of the Bharatiya Nyaya Sanhita alongside the Information Technology Act. Investigating teams have begun tracking the digital footprints of the sender addresses, analyzing payment dispatch logs, and serving notices to determine the beneficial ownership of the bank accounts that received the transferred funds.
The preliminary inquiry focuses on determining whether the scheme involved unauthorized access into existing email accounts, compromised correspondence threads, or external spoofing designed to mimic IE Park SRL. Police teams are coordinating with banking institutions to freeze the beneficiary accounts and reconstruct the transaction route used to siphon off the Rs 1.64 crore. No suspects have been formally detained, and the exact identities of those who coordinated the fraud remain subject to active police verification.
Corporate Safeguards Challenged by Cross-Border Deception
The cyber fraud highlights the expanding vulnerabilities confronting multinational conglomerates that run large-scale cross-border supply chains. Headed by M.A. Yusuff Ali, Lulu Group maintains an extensive commercial network spanning hypermarkets, shopping malls, shipping, trading, and information technology divisions across the Middle East and India. These international operations demand continuous digital exchanges of invoices and remittance details with overseas manufacturers, exposing routine procurement channels to targeted impersonation.
The Kochi investigation demonstrates the operational risks of processing international wire transfers without enforcing multi-layered verification protocols. Industry practices recommend verifying banking alterations over confirmed telephone channels, mandating multi-person administrative approvals for high-value overseas remittances, and conducting routine cyber awareness programs for finance personnel. While the Kochi Cyber Crime Police continue efforts to identify the culprits and locate the diverted capital, the case serves as a sharp reminder of the procedural diligence required to guard against business email fraud.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
