15 CFOs in BKC get spoof emails for funds transfer

Mumbai: The Bandra-Kurla Complex (BKC) cyber police are probing at least 15 instances of an online spoofing scam where chief financial officers (CFOs) of corporate houses have received fake emails ostensibly from their company managing directors, demanding urgent wire funds transfer.
Cyber cops received the complaints over a span of three weeks from CFOs, some of whom executed the transfer.
Investigators told TOI that earlier, spammers used to make minor alterations in email IDs.Today, they manage to create lookalike IDs.
A CFO of an MNC became the latest victim of an email spoof on Monday when he transferred Rs 18.6 lakh from the company’s account to three unidentified bank accounts. The CFO did not verify the sender of the email who impersonated as the MD.
“The CFO did not verify the email or cross-check with the MD. He received a total of three emails. The spammer, posing as the MD, instructed that Rs 6.2 lakh be transferred in each of the accounts,” said the cop. In his complaint, the CFO said, “I discovered the fraud when I inquired with the MD about the receipts for the three transactions and he replied that he had never asked for any.”
Cyber cops immediately reacted and succeeded in freezing the accounts and stopped payment of at least Rs 14 lakh on receiving a call from one of the company’s staffers alerting them about the fraud. “Timely alert helped freeze the maximum amount,” said the cyber police.
Last month, the finance head of a city-based non-government organization (NGO), too, fell victim to a similar email spoof when he transferred Rs 20 lakh and Rs 14 lakh on two occasions. “The finance head learned about the fraud only when he received more emails and showed them to the head.” While deputy commissioner of police (cyber) Sachin Patil confirmed the email spoofs, he did not divulge any details.
Cyber lawyer Prashant Mali said in email spoofing, the fraudster modifies the email header of the sender. “Email spoofing is more common with email accounts that are not actively used. This technique is also used by spammers so they do not receive bounced emails. Most targets are in the SME segment with a specific focus on importers and exporters,” said Mali. IT expert Vijay Mukhi said cases are on the rise because in India employees are scared of cross-checking with bosses and obey instruction blindly.