Compromised Supplier Email Chain Fraud
INDIA — By BharatSecure Threat Intelligence Team ·
Verdict: Suspicious | Risk Score: 8/10 | Severity: high
How Compromised Supplier Email Chain Fraud Works
Overview: In the Compromised Supplier Email Chain Fraud, attackers gain access to a real supplier’s email account and use it to send seemingly legitimate messages requesting payment detail changes. Targeted primarily at the accounts teams of Indian companies with long-term vendor relationships, this scam is especially risky because the attacker replies within authentic email threads, making detection hard and losses potentially huge. How It Works: The fraudster fully compromises a supplier’s inbox using credentials stolen in a previous phishing attack. They monitor ongoing conversations, waiting for the right moment (often close to delivery or invoicing) to send a payment advice asking for funds to a different account. These emails use real signatures, prior correspondence, and documents, avoiding detection by even seasoned staff. India Angle: This approach has been witnessed among Indian exporters and large domestic firms, often in Mumbai, Hyderabad, and Chennai. Local languages such as Hindi, Marathi, or Telugu may be used. Sometimes, WhatsApp or phone calls confirm the payment request 'from the supplier’s number.' Real Examples: - Email: "Further to our last conversation, please process the May payment to the new account attached. Our old account is under review. Thank you, [Supplier Name]." Red Flags: 1. Payment change requests within an otherwise normal-looking email thread 2. Attachments with new bank account info but no official supplier letterhead 3. Follow-up calls from unfamiliar numbers claiming to be the supplier 4. Timing that coincides with usual payment schedules Protective Measures: Institute mandatory callbacks to a supplier’s verified phone number for any change in banking details, regardless of email content. Educate all finance employees to suspect even seemingly valid emails if bank instructions change. Enable two-factor authentication for business email accounts and review user permissions for supplier correspondence. If Victimised: Ask your bank to block or reverse the transfer, inform your IT team to investigate email security, and file a complaint with cybercrime.gov.in and 1930. Related Scams: Supplier domain spoofing, fake invoice scams, and business email compromise with credential theft.
How This Scam Works — Detailed Explanation
Compromised Supplier Email Chain Fraud typically begins with scammers researching potential targets via LinkedIn or other platforms. Attackers often gather extensive information about the vendors and companies by observing their business relationships and email communications. They look for long-term suppliers that have consistent back-and-forth communications with accounts teams. Using techniques like phishing, they gain access to a supplier’s email account. The compromised account serves as their gateway, allowing them to send out fraudulent emails that appear legitimate and are sent directly from the supplier's actual email address.
Once attackers have access to a supplier's email account, they craft messages that appear normal and are designed to achieve specific outcomes. They may send emails requesting changes in banking details, with justifications buried in threads of real conversations that have occurred in the past. The psychological approach often includes urgency—asking for the changes to be implemented quickly or highlighting that it’s a routine request. By mimicking the language and style of their target's previous communications, they make it difficult for the accounts teams to distinguish between legitimate messages and scams.
When victims receive an email asking for a bank change request, the typical action is to comply without verifying the request. For example, a small manufacturing firm in India may receive such an email stating that the bank account for supplier payments has changed, requesting the new details to be used for their next payment cycle. If the team at the firm is not on high alert, they may blindly follow through with the instructions. These processes are made easier with UPI transactions, as most invoices can be settled quickly without additional verification via phone or direct contact with the supplier. It’s not uncommon for unsuspecting businesses to lose substantial amounts—sometimes upwards of ₹1 crore in a single transaction—as they transfer funds to the fraudster's account instead of the legitimate supplier.
The impact of such scams in India is alarming. Reports indicate that businesses have collectively lost over ₹100 crore to such fraudulent activities in just the last year, highlighting the severity of the issue. As outlined in advisories from CERT-In, these scams often exploit the gaps in communication protocols among companies and their suppliers. The Ministry of Home Affairs has issued direct warnings about the increasing occurrence of Compromised Supplier Email Chain Fraud, underscoring the importance for all businesses to implement robust verification processes. Financial institutions like the RBI have also emphasized knowing your vendor processes, given how easily this type of fraud can escalate into significant financial losses.
To spot this scam versus legitimate communications, stay vigilant for telltale signs. Look out for bank change requests that are inexplicably buried within typical conversations. Confirm any changes directly with your supplier using a verified phone number, not the one provided in the suspicious email. Always think critically about unexpected changes that align with your payment cycles and be cautious with any attachments that call for new account details. Compare phone numbers in emails to existing records to ensure consistency. By applying these techniques, businesses can significantly reduce the risk of falling victim to Compromised Supplier Email Chain Fraud.
Visual Intelligence:
BharatSecure's AI has identified this as a used in scams targeting Indian users.
Who Does Compromised Supplier Email Chain Fraud Target?
General public across India
Red Flags — How to Identify Compromised Supplier Email Chain Fraud
- Bank change requests buried in regular email threads
- Suspicious attachments with new account details
- Supplier phone numbers do not match existing records
- Unexpected changes matching payment date cycles
What To Do If You Encounter Compromised Supplier Email Chain Fraud
- Report the incident to the cybercrime helpline by calling 1930 or visiting cybercrime.gov.in.
- Contact your bank immediately to freeze any related transactions or accounts.
- Ensure to verify any requests for payment alterations directly with suppliers using an official communication channel.
- Educate your team about the potential red flags of this kind of email fraud.
- Set up multi-factor authentication on email accounts to add an extra layer of security.
- Regularly train employees on cybersecurity awareness, focusing on email security and phishing.
How to Report Compromised Supplier Email Chain Fraud in India
- Call 1930 — National Cyber Crime Helpline (24x7)
- File a complaint at cybercrime.gov.in
- Contact your bank immediately if money was lost
- Call RBI helpline: 14440 for banking fraud
Frequently Asked Questions
- What should I do if I suspect I've fallen for a WhatsApp scam?
- Immediately contact your bank and report the incident to the cybercrime helpline at 1930. You can also visit cybercrime.gov.in for further guidance.
- How can I tell if an email is a scam or legitimate?
- Look for irregularities such as unexpected attachments, requests for sensitive info in existing email threads, and discrepancies in contact details. Compare sender addresses with your contacts.
- How do I report Compromised Supplier Email Chain Fraud?
- You can report this type of scam by calling the cybercrime helpline at 1930, or submitting a complaint online through cybercrime.gov.in. Also, notify your bank immediately.
- How can I protect my accounts after a scam?
- Change your passwords for affected accounts, enable two-factor authentication, and notify your bank. Monitor account statements carefully for any unauthorized transactions.
Related Scams in India
Verify Any Suspicious Message
Check any suspicious message, link, or call for free at bharatsecure.app. BharatSecure uses AI to detect scams in real-time and protect Indian users.