A city-based businessman lost close to Rs 20 lakh after fraudsters hijacked his correspondence with a Dubai supplier and rerouted a payment meant for a shipment of doors and windows into their own account.
Indrajit Basu, 32, has told the Cyber Crime police station that the fraud unfolded over nearly two months, between May 25 and July 13 this year. Basu had placed an order for material with True Sea Services FZC, a Dubai-based company, after reaching out to the firm through its website and official email address. He sent an advance of $11,216.21 through SWIFT on March 10 to the company's genuine bank account, and the order moved ahead as planned.
The trouble started while the goods were still being readied. Police say an unidentified person created a near-identical email address, swapping the supplier's genuine inquiry@trusea.ae for inquiry@trusea-ae.com, a domain close enough to pass an unhurried glance. Messages sent from this lookalike address, still carrying the True Sea Services name, informed Basu that the company's bank details had changed. In their place was an account said to belong to First Abu Dhabi Bank PJSC, complete with an IBAN number and a listed branch address.
Basu had no reason to doubt the communication and processed the documentation for the balance payment accordingly. On June 9, he wired $20,830, roughly Rs 19.75 lakh at the time, to the new account. The money never reached the actual supplier, and repeated follow-ups brought no resolution, at which point Basu approached the police.
The Cyber Crime police registered a complaint on Thursday night under relevant sections of the Bharatiya Nyaya Sanhita and the Information Technology Act. The named accused include whoever operated the fraudulent email address, the person who holds and controls the bank account that received the transfer, and others believed to have taken part in the conspiracy. Investigators are working to trace the account holder and the digital trail left by the spoofed domain.
Basu's case falls squarely into the bracket Gujarat Police now treats as serious enough to route away from local stations. Under a restructuring the state carried out this year, complaints involving losses above Rs 10 lakh are handled exclusively by dedicated Cyber Crime Police Stations rather than the jurisdictional police, precisely because cases of this size tend to involve cross-border transfers and mule accounts that local units are not equipped to trace.
The scale of the problem in Gujarat gives that decision some context. State figures put cumulative cyber fraud losses at around Rs 3,707 crore, with roughly Rs 1,435 crore of that lost in 2025-26 alone, and only about 3 percent of the total has been recovered so far. Police have leaned on what they call the golden hour, the narrow window right after a fraudulent transfer in which a call to the national helpline, 1930, or a report on the National Cyber Crime Reporting Portal can still get an account frozen before the money is moved on. Gujarat Police's Operation Mule Hunt, which wrapped up its first phase in June, flagged more than 900 mule accounts and led to over 600 arrests, stressing how heavily this kind of fraud depends on layers of accounts opened specifically to receive and quickly disperse stolen funds.
The method used against Basu, a lookalike domain slipped into an active supplier conversation, is what cybersecurity researchers classify as vendor email compromise, a variant of the broader business email compromise problem that the FBI's Internet Crime Complaint Center logged at nearly 25,000 complaints and just over $3 billion in reported losses in the US alone in 2025, both figures higher than the year before. Security researchers who track these schemes note that attackers increasingly avoid tipping off a target with an urgent, out-of-context demand for money. Instead they wait inside a live, legitimate transaction, often after quietly monitoring an inbox for weeks, and strike only when a payment is already due, using a domain that differs from the original by a hyphen, an extra letter or a swapped top-level domain, easy to miss on a quick read. Investigators and bank officials advise businesses dealing with overseas suppliers to treat any mid-transaction change in payment or account details as a red flag, and to confirm such changes only through a phone number sourced independently of the email itself, rather than one supplied in the message.
