Dual-Channel Corporate Email Scam

How Dual-Channel Corporate Email Scam Works

Overview: The Dual-Channel Corporate Email Scam targets employees of Indian companies, especially those working in finance, accounts, or administration. Scammers use both company email and instant messaging apps like WhatsApp or SMS to trick staff into making unauthorized payments or sharing sensitive data. These scams are highly dangerous because they move victims off official channels, bypassing organizational security and hindering detection. Victims range from senior managers to junior finance officers, with losses sometimes exceeding Rs 50 lakh per incident. How It Works: 1) The scammer gains access to or spoofs the email of a company executive (like a CEO). 2) They send an urgent email requesting a confidential task, such as a wire transfer. 3) The email instructs the employee to continue communication via WhatsApp or personal email for 'privacy' or 'security'. 4) On the alternative channel, the scammer applies pressure (urgency, confidentiality) and shares fraudulent payment details. 5) The victim completes the payment or shares sensitive company data, believing they are acting on legitimate orders. India Angle: Indian firms, especially in metros like Mumbai, Bengaluru, and Delhi, are prime targets. WhatsApp and SMS are commonly used secondary channels due to their widespread use. Businesses lacking strong digital protocols, especially SMEs and startups, are especially vulnerable. In India, scammers typically exploit poor vendor verification and the trust placed in hierarchy. Real Examples: - "Hi, this is Anil Jain, MD, urgently text me on 9xxxxxxx for confidential matter. Do not use company mail." - "Due to new policy, wire Rs 12 lakh to new vendor account today; confirmation only on this WhatsApp for secrecy." Red Flags: - Sudden switch from corporate email to WhatsApp/SMS for sensitive requests - Request for urgent fund transfers bypassing standard approval - Payment instructions that override regular company procedures - Pressure to keep the transaction confidential - Email address[ADDRESS_REDACTED] Protective Measures: - Always verify payment requests independently via a known phone number - Never move sensitive business matters to personal messaging apps - Insist on dual authorization for all payments - Conduct staff training on dual-channel scams - Monitor for any attempts to move work outside secure platforms If Victimised: - Stop payments immediately and alert your bank - Report to 1930 and cybercrime.gov.in - Inform company IT and senior management - Collect and preserve all scam communications Related Scams: - Vendor impersonation scams (fraudulent payment instructions) - Executive impersonation phishing - Invoice redirection fraud

How This Scam Works — Detailed Explanation

The Dual-Channel Corporate Email Scam predominantly targets employees in Indian companies, especially those in finance, accounts, or administration. Scammers often begin by researching their targets through professional networking sites like LinkedIn, where they gather information about company hierarchies and key personnel. They often impersonate senior executives or trusted vendors, utilizing official company emails to initiate contact with unsuspecting victims. After establishing communication through email, they swiftly redirect their targets to more immediate messaging platforms like WhatsApp or SMS under the guise of urgent matters. This creates a false sense of security and increases the chances of manipulation, as detailed discussions occur off the official corporate channels.

To lure victims effectively, scammers employ various psychological tricks. They often create a sense of urgency and provoke fear, claiming that failure to follow specific instructions could lead to grave consequences for the company. These messages may contain phrases like "this is an urgent payment due for a vendor to avoid penalties" or similar threats that exert pressure on employees. Additionally, they make minor changes to executive email addresses—such as replacing a zero with an ‘O’—and employ language that sounds authoritative yet maintains an informal tone that might convince employees to bypass their typical verification processes.

Victims of this scam often find themselves receiving a series of manipulative communications. Initially, they may receive what appears to be a legitimate email from a company executive ordering them to make an immediate payment, often to an external bank account or a payment link. Once the victim engages via WhatsApp, the scammer will continue to push for specific payment details. Victims are sometimes asked to share their Aadhaar details along with bank credentials to ‘verify’ the transaction's legitimacy. These conned employees often lose substantial amounts of money; for example, one large company reported losses of over ₹20 crore due to such scams over the last two years, as reported in news articles.

The real-world impact of the Dual-Channel Corporate Email Scam in India is significant. The Ministry of Home Affairs (MHA) and the Reserve Bank of India (RBI) frequently issue advisories alerting the public and businesses about these growing threats, citing that cyber frauds collectively led to losses of over ₹4,000 crore in 2022 alone. CERT-In, the national cybersecurity agency, has highlighted the increasing sophistication of these scams in their advisories. Recent statistics indicate that over 20% of corporate employees report being targeted by such scams in their daily work, further illustrating the pervasiveness of this threat across Indian companies.

To differentiate legitimate communications from potential scams, employees should be attuned to specific red flags. Standards like abrupt shifts in communication methods, requests for confidentiality, or alterations in email addresses should raise alarms. It's vital to question any immediate payment requests that override standard payment protocols. Always verify such communications with the supposed sender through a known corporate channel, rather than the one provided in the suspicious email, before any actions are taken. Utilizing internal confirmation processes helps maintain safeguards against these deceptive tactics.

Visual Intelligence:

BharatSecure's AI has identified this as a used in scams targeting Indian users.

Who Does Dual-Channel Corporate Email Scam Target?

General public across India

Red Flags — How to Identify Dual-Channel Corporate Email Scam

• Urgent email requests to move to WhatsApp or SMS
• Payment orders overriding standard checks
• Unusual confidentiality around financial transactions
• Slight misspelling in executive email addresses
• Instructions to bypass company verification steps

What To Do If You Encounter Dual-Channel Corporate Email Scam

1. Report the incident immediately by calling the cybercrime helpline at 1930 or visiting cybercrime.gov.in.
2. Contact your bank's customer service helpline to report unauthorized transactions (for SBI call 1800-11-1109, for HDFC call 1800-202-6161).
3. Inform your company's IT and security departments about the incident and any compromised credentials.
4. Collect all evidence related to the scam, including screenshots and conversation logs, for reporting to authorities.
5. Change your security passwords for email and financial accounts immediately.
6. Educate yourself and colleagues about the Dual-Channel Corporate Email Scam to avoid falling victim in the future.

How to Report Dual-Channel Corporate Email Scam in India

• Call 1930 — National Cyber Crime Helpline (24x7)
• File a complaint at cybercrime.gov.in
• Contact your bank immediately if money was lost
• Call RBI helpline: 14440 for banking fraud

Frequently Asked Questions

What to do if I shared my banking details in a WhatsApp scam?

Immediately contact your bank helpline to report the incident and ask them to block your account. You should also report the scam to the cybercrime helpline at 1930.

How can I identify the Dual-Channel Corporate Email Scam?

Look for signs such as urgent requests to switch to WhatsApp, minor discrepancies in email addresses, and instructions to circumvent standard verification checks.

How do I report this type of scam in India?

You can report scams to the cybercrime helpline at 1930, report online at cybercrime.gov.in, and also notify your bank immediately.

What steps can I take to recover money after falling victim to this scam?

Contact your bank to see if they can reverse the transaction. Report to local authorities and file a complaint with the cybercrime department for further assistance.

Verify Any Suspicious Message

Check any suspicious message, link, or call for free at bharatsecure.app. BharatSecure uses AI to detect scams in real-time and protect Indian users.