A CEO's email compromised, ₹68 lakh wired to a "vendor" — and a money trail that led through four states.
The accounts head of a Bengaluru logistics firm received an email from the CEO — correct address, correct signature, familiar tone — instructing an urgent vendor payment of ₹68 lakh. The CEO was mid-flight and unreachable; the payment went out. The real vendor called three weeks later asking about their unpaid invoice.
Arjun's lab imaged the mail server and found the compromise: a credential-harvesting page the CEO had entered his password into, hosted behind a lookalike domain registered eleven days before the fraud. We traced the mule account chain across four states, identified the first-hop account holder through KYC records obtained via the police complaint we helped draft, and mapped the network to a known compound operating out of Jamtara.
Because the complaint was filed with a complete technical annexure — headers, domain forensics, hash-verified images and the mule chain — the cyber cell moved fast, freezing ₹41 lakh across three accounts. The firm recovered 60% of the loss, implemented the payment-verification protocol we designed, and put the whole finance team through our fraud-awareness workshop.
Client names, locations and identifying details have been altered to protect confidentiality. Amounts and methods are reported as they occurred.
Speak to a senior investigator today. Your identity stays protected from the very first call — even from us, if you prefer.
