Lulu Group has allegedly lost approximately ₹1.64 crore in an email impersonation fraud in which unidentified individuals posed as representatives of its long-standing Italian business partner, IE Park S.R.L. According to the complaint reported by multiple Indian news outlets, the fraudsters sent emails containing invoices and bank account details for outstanding payments related to gaming equipment. Believing the communications to be genuine, Lulu Group transferred €150,500 to accounts provided by the impersonators.
Kochi City Cyber Crime Police registered a case on October 23, 2026, following a complaint by Deepak Sreedhar Nair, legal manager at Lulu Group. The alleged fraud took place between September 2 and September 29, according to the first information report (FIR). Investigators are working to identify those responsible and trace the transactions. The incident highlights the continuing risk of business email compromise, a form of cybercrime in which attackers impersonate trusted business contacts to redirect legitimate payments.
Key Takeaways
- Financial loss: Lulu Group reportedly transferred €150,500, equivalent to approximately ₹1.64 crore, to accounts provided by alleged fraudsters.
- Impersonated company: The accused allegedly posed as representatives of IE Park S.R.L., an Italian company with an established business relationship with Lulu Group.
- Fake invoices: The emails sought payment for gaming equipment and included fraudulent banking information.
- Police investigation: Kochi City Cyber Crime Police registered an FIR on October 23, 2026.
- Unknown suspects: The individuals behind the alleged fraud have not been publicly identified.
- Business security lesson: Companies should independently verify changes to payment instructions and require additional authorization for high-value transfers.
How the Email Impersonation Fraud Allegedly Happened
According to the FIR, the alleged fraud unfolded over approximately four weeks in September 2026. The unidentified individuals reportedly created email addresses resembling those associated with IE Park S.R.L., an Italian company that had an established business relationship with Lulu Group.
Using these addresses, the alleged fraudsters contacted the retail group and sent invoices and bank account details requesting payment of outstanding dues for gaming equipment. Because the messages appeared to come from a familiar business partner and concerned an existing commercial transaction, the payment requests were reportedly treated as legitimate.
Lulu Group subsequently transferred €150,500 to the bank accounts specified in the communications, according to the complaint. The amount was reported as approximately ₹1.64 crore.
The case demonstrates how fraudsters can exploit routine business processes. When companies regularly exchange invoices, purchase orders and payment instructions with international suppliers, a convincing impersonation can make a fraudulent request appear indistinguishable from ordinary correspondence.
The investigation is ongoing, and the precise method used to create or operate the fraudulent email accounts has not been conclusively established in the available reporting.
What Is Business Email Compromise?
Business email compromise, commonly known as BEC, is a type of fraud in which criminals manipulate business communications to persuade an organization to send money or disclose sensitive information.
Attackers may impersonate a senior executive, supplier, contractor or other trusted contact. They can use lookalike email addresses, compromised accounts or forged messages to make requests appear authentic.
In invoice fraud, criminals often exploit an existing commercial relationship. A business expects to pay a supplier, so the attacker sends an invoice or payment instruction that appears to fit the transaction. If the recipient does not independently verify the banking information, funds can be transferred to an account controlled by the fraudster.
The Lulu Group case reportedly involved email addresses resembling those of an established Italian business partner. However, the available reports do not confirm whether the original supplier’s email account was compromised or whether the fraudsters relied entirely on lookalike addresses.
That distinction matters because the security response differs: account compromise may require password resets and investigation of unauthorized access, while lookalike-address fraud calls for stronger email verification and payment controls.
Timeline of the Lulu Group Fraud Case
| Date or period | Reported development |
|---|---|
| September 2–29, 2026 | Period during which the alleged fraud occurred, according to the FIR |
| During the alleged fraud | Impersonators reportedly sent invoices and bank details related to gaming equipment |
| September 2026 | Lulu Group reportedly transferred €150,500 to the accounts provided |
| October 23, 2026 | Kochi City Cyber Crime Police registered an FIR following a complaint |
| October 24, 2026 | News reports brought the alleged fraud into public view |
| Current status | Police investigation continues; the accused have not been publicly identified |
Sources: The New Indian Express and The Economic Times.
What Are the Police Investigating?
Kochi City Police registered the case at the Cyber Crime Police Station after receiving a complaint from Lulu Group’s legal manager. Reports say the FIR invokes provisions of the Bharatiya Nyaya Sanhita (BNS) and the Information Technology Act.
The investigation is expected to establish who controlled the fraudulent email addresses and the recipient bank accounts, how the payment instructions were delivered, and where the transferred money went. Authorities may also need to determine whether the fraud involved compromised correspondence, forged electronic records or other methods of impersonation.
The suspects have not been publicly identified in the reports reviewed for this article. There is also no confirmed public finding that establishes how the alleged perpetrators obtained information about the supplier relationship or whether any employees or third parties were involved.
The case remains an allegation under investigation. The reported details come from the complaint and police-related reporting, rather than a final judicial determination.
Why Large Businesses Remain Vulnerable to Invoice Fraud
Large companies often process substantial volumes of invoices and international payments across multiple departments. This creates opportunities for attackers to exploit the gap between the people who manage supplier relationships and those who authorize transfers.
A fraudulent request may look legitimate because it references a real order, a familiar supplier and an outstanding payment. Even careful employees can overlook a subtle difference in an email address when messages arrive during busy periods.
Cross-border transactions can make verification more difficult because companies may work across time zones and depend heavily on email for routine communication. Criminals can exploit these circumstances by creating urgency or presenting a payment request as a normal administrative step.
The lesson is not that email-based business transactions are inherently unsafe. Rather, email alone should not be treated as sufficient proof that a payment instruction is genuine.
How Companies Can Prevent Similar Email Frauds
Organizations can reduce the risk of payment diversion by combining technical security measures with clear financial controls.
- Verify bank-account changes independently: Contact the supplier using a previously verified telephone number or communication channel. Do not rely on contact details supplied in the suspicious email.
- Use dual authorization: Require approval from at least two authorized employees for high-value or international payments.
- Check sender addresses carefully: Train employees to recognize lookalike domains, unusual reply-to addresses and suspicious changes in communication patterns.
- Secure email accounts: Use multifactor authentication, restrict account access and monitor suspicious login activity.
- Establish supplier verification procedures: Confirm payment details when onboarding vendors and whenever banking information changes.
- Act quickly after a suspected fraud: Contact the sending bank, request an urgent payment recall where possible, notify the relevant cybercrime authorities and preserve emails, invoices and transaction records.
These measures cannot guarantee that every attack will be prevented, but they can make it harder for criminals to turn a convincing email into a completed financial transfer.
The Bigger Picture
The alleged fraud involving Lulu Group illustrates a persistent weakness in digital commerce: businesses may have strong financial systems but still rely on human judgment to determine whether a supplier’s email is genuine. Criminals do not always need to breach a company’s core network if they can manipulate the communication that triggers a legitimate payment.
As international supply chains become increasingly digital, companies will need to treat supplier identity verification as part of payment security rather than as a routine administrative task. Independent confirmation, segregated approval responsibilities and rapid incident response can help reduce exposure to this type of fraud.
The police investigation will determine more about how the alleged scheme operated and whether the transferred funds can be traced or recovered. Until those findings become public, the case serves as a reminder that a familiar name, a convincing invoice and a valid-looking email address are not sufficient evidence that a payment request is authentic.
FAQs
1. How much money did Lulu Group reportedly lose?
Lulu Group reportedly transferred €150,500, equivalent to approximately ₹1.64 crore, to bank accounts provided by individuals allegedly impersonating representatives of an Italian business partner.
2. Which company was allegedly impersonated?
The accused reportedly posed as representatives of IE Park S.R.L., an Italian company that had an established business relationship with Lulu Group.
3. When did the alleged fraud take place?
According to the FIR, the alleged fraud occurred between September 2 and September 29, 2026. Kochi City Cyber Crime Police registered a case on October 23.
4. Have the accused been arrested?
The reports reviewed for this article state that the individuals responsible had not been publicly identified. The police investigation is continuing, and no final determination of guilt has been reported.
5. How can businesses protect themselves against email impersonation fraud?
Businesses should verify banking changes through previously established communication channels, require multiple approvals for high-value payments, secure email accounts with multifactor authentication and train staff to detect suspicious messages. Suspected fraud should be reported to banks and cybercrime authorities immediately.
Looking Ahead
The next significant development will be the outcome of the Kochi Cyber Crime Police investigation, including whether investigators identify the people controlling the fraudulent email accounts and trace the destination of the transferred money. Any confirmed recovery of funds or new information about the method used will help clarify the scale and mechanics of the alleged scheme.
For businesses, the case reinforces the need to build independent verification into payment processes. As fraudsters continue to exploit trusted supplier relationships, companies that combine email security with strict financial approvals will be better positioned to prevent fraudulent invoices from turning into costly losses.
Get the day’s top stories in your inbox
One concise email. No spam, unsubscribe anytime.
