The company, with its office in Udyog Vihar, is engaged in “food solutions, delivering high quality products to its customers through superior food knowledge”. It receives supplies from different parts of the world from different suppliers. On January 25, the company received an email from one of its Spain-based suppliers, which provides pickled and brined fruits and vegetables, salad dressings, vegetable relishes, sauces and seasonings. It contained a scanned copy of a letter written on the Spanish firm’s letterhead, in which it made a request to change account details for receiving funds against supplies it made.
In their police complaint, the representative of the Gurugram firm mentioned they had received the email from the email ID: firstname.lastname@example.org, which was often used by the Spanish company for correspondence. “From time to time, the supplier used this email ID for communication in the past,” reads the police complaint.
Relying on the email and letter attached to it, the Gurugram company changed the details of the supplier’s bank account in its books, and added it as beneficiary for payments to the Spanish supplier. In three transactions on February 20, the Gurugram company transferred Rs 1.74 crore to this new account, against supplies of some food products made in January-February.
To their surprise, on February 26, they received an email from the Spanish supplier demanding payment for outstanding dues, saying they hadn’t received the payment. The Gurugram firm forwarded details of its payments and attached the notification of successful transfer from Indian Bank, from whose account the payment was made to an European bank account.
After checking the details, the supplier replied that the payment has gone to an account which does not belong to them, adding the January 25 email hadn’t been sent by them but by a hacker. They instructed the Gurugram firm to immediately cancel the transaction. The Gurugram firm contacted the bank, but by then, the payment had already been transferred and diverted from there to another account. Realising they had been duped, the victims approached Gurugram cyber police station on February 28.
A case was registered at cyber police station on Monday against unknown persons, under sections 406 (criminal breach of trust), 420 (cheating) of IPC and Section 66D (cheating by personation by using computer source) of IT Act. “A case has been registered and we are investigating it,” said Gurugram police spokesperson Subhash Bokan.