Kochi City Police have launched a formal investigation into a sophisticated email fraud that allegedly led Lulu Group to transfer about Rs 1.64 crore to accounts linked to unidentified impostors. The case, registered on the basis of a complaint and the first information report, points to a classic business-email compromise scheme in which criminals exploited the identity of a foreign supplier to divert a legitimate corporate payment.
The alleged fraud is notable not only for the size of the loss but also for the method used. According to the FIR, the perpetrators impersonated representatives of an Italian company and communicated with Lulu Group through email using fabricated invoices and bank details. The payment in question related to gaming equipment, and the group was reportedly persuaded to remit 150,500 euros to the accounts specified in the fraudulent correspondence. By the time the deception was uncovered, the funds had already been transferred.
Fraudulent Payment Trail
The case underscores how email-based impersonation remains one of the most effective tools in modern corporate fraud. Rather than relying on technical intrusion alone, the suspects appear to have manipulated routine procurement and payment processes by inserting themselves into an existing commercial relationship. Such schemes often succeed because they mimic the language, formatting and urgency of legitimate vendor communications, making the false instructions difficult to detect in time.
In this instance, the use of an Italian company's identity added a layer of credibility to the deception. Cross-border transactions, foreign currency payments and vendor verification procedures can create operational blind spots, particularly when procurement teams are handling time-sensitive orders. The alleged transfer of 150,500 euros suggests that the fraudsters were able to exploit trust in a way that bypassed internal checks or overrode normal caution.
For a retail conglomerate of Lulu Group's scale, the incident is a reminder that even well-resourced organisations remain exposed to targeted financial crime. Large enterprises typically process high volumes of vendor payments, often across jurisdictions and currencies, which increases the attack surface for impersonation fraud. Criminals increasingly rely on social engineering rather than malware, knowing that a convincing email can be enough to trigger a transfer if verification protocols are weak or inconsistently applied.
Police Probe Underway
Police have begun tracing the accounts that received the money and examining the email trail used in the transaction. Investigators are expected to focus on the origin of the messages, the domains used by the impersonators, the banking channels involved and whether the fraud was executed from within India or through a wider transnational network. Such cases often require coordination with banks and, where necessary, international counterparts to identify beneficiaries and preserve evidence.
The complaint also raises broader questions about corporate controls in high-value procurement. Businesses handling imports, equipment purchases and foreign vendor payments are increasingly expected to maintain layered verification systems, including call-back confirmation, dual authorisation, domain authentication and strict change-management rules for bank details. When those safeguards fail, recovery becomes difficult because fraudulent transfers can be rapidly moved through multiple accounts.
The Lulu Group case fits a pattern seen across sectors in which attackers impersonate suppliers, executives or legal intermediaries to redirect payments. The automotive, EV and mobility ecosystem is especially vulnerable to such tactics because it depends heavily on cross-border sourcing, component imports and recurring vendor settlements. As supply chains become more digitised, the risk of email impersonation grows alongside the speed of commerce.
For now, the police case marks the start of what is likely to be a detailed forensic inquiry into how the fraud was executed and whether the money can be traced. The immediate loss is substantial, but the larger significance lies in the method: a reminder that in corporate finance, the weakest point is often not the payment system itself, but the human trust that surrounds it.