Business email compromised in Delhi? Learn how to report corporate email hacking, handle payment diversion fraud, preserve digital evidence and take legal action.

An accounts manager in Delhi receives an email from the “managing director” asking for an urgent transfer. A vendor’s email suddenly shows a new bank account. A few hours later, the money is gone and the real sender knows nothing about it. This is business email compromise, and it is now one of the costliest forms of cyber fraud faced by Indian companies.

In 2026 the Indian Cyber Crime Coordination Centre (I4C) and SEBI have both warned organisations about a newer variant called the “Boss Scam”, where criminals impersonate senior executives or regulators by email and WhatsApp. For Delhi businesses, corporate email hacking is no longer a distant risk. As advocates, we explain here how BEC fraud works, what the law says, and how to act in the first hours after an attack.

What Is Business Email Compromise?

Business email compromise is a targeted fraud in which a criminal uses a hacked, spoofed or look-alike email account to trick a company, its staff or its vendors into sending money or sensitive data. It depends more on deception than on technical skill, which is why even careful businesses are caught.

The common forms of corporate email hacking are:

• CEO or Boss fraud: A fake instruction from a senior executive asks finance staff for an urgent, confidential payment.
• Vendor email compromise: A supplier’s genuine account is hacked, and the criminal sends a real-looking invoice with changed bank details.
• Account takeover: A director’s or accountant’s mailbox is accessed, and the criminal silently reads mail and sets forwarding rules.
• Fake invoice or payment diversion: A forged invoice, or an edit to a genuine one, redirects the payment.
• Regulator or authority impersonation: Fake notices in the name of RBI, tax or police authorities demand urgent action or information.
• Data theft through email: Payroll, client or contract data is taken from a compromised mailbox and later used for blackmail or further fraud.

How an Attack Unfolds and the Warning Signs

Most BEC fraud follows a pattern:

1. Entry: A phishing link, a malicious attachment or a leaked password gives the criminal access to a mailbox. In the newer Boss Scam, a malicious file sent by email or WhatsApp can also hijack a WhatsApp account.
2. Watching: The criminal reads mails for days or weeks, learning who approves payments, the usual tone and the billing cycle.
3. Setting the trap: A mailbox rule hides replies, or a look-alike domain is registered with one letter changed.
4. The request: An urgent, confidential payment instruction arrives at the right moment, often when the executive is travelling or in a meeting.
5. Cash-out: The money moves quickly through several mule accounts, and often abroad.

Watch for these warning signs:

• A sudden change of bank account for a regular vendor.
• Urgency, secrecy, or a request not to call back.
• An email address or domain that differs by a letter or symbol.
• A regulator or senior official asking for payment or files on email or WhatsApp.
• Mailbox rules or forwarding addresses you did not set up.
• Login alerts from unfamiliar locations.

Laws That Apply to Email Hacking and BEC

An email hacking case involving a business usually attracts several laws at once. Which sections are used depends on the facts of your case.

Law or rule	What it covers
IT Act, 2000, Section 43 and 66	Unauthorised access to a computer or email account, done dishonestly or fraudulently
IT Act, Section 66C	Fraudulent use of someone else’s password or identity
IT Act, Section 66D	Cheating by personation using a computer resource
BNS Section 318	Cheating and dishonestly inducing delivery of property
BNS Section 319	Cheating by personation
BNS Section 336	Forgery of electronic records, such as fake invoices
BNS Section 61	Criminal conspiracy, where several people are involved
CERT-In Directions, 28 April 2022	Companies and other covered entities must report specified cyber incidents to CERT-In within six hours of noticing them
Digital Personal Data Protection Act, 2023	Duties of a company that holds personal data, relevant where a hacked mailbox leaks customer or employee data

Separately, sector regulators have started issuing cautions. SEBI issued a caution to regulated entities and listed companies about Boss Scams on 17 July 2026, after an I4C alert. Companies in regulated sectors should check what their own regulator expects.

The Golden Hours: What to Do Right After a Fraud

In business email compromise, speed decides whether money can be recovered. In one Delhi case reported in 2026, police intervention led to roughly Rs 4 crore of a Rs 7.8 crore fraud being frozen. Do these things at once:

1. Call your bank’s fraud desk and ask it to recall or hold the transfer, and email the branch manager in writing with the transaction details.
2. Call 1930 and then complete the complaint on cybercrime.gov.in. The helpline alerts the banks in the chain so that funds can be put on hold.
3. Secure the compromised accounts. Change passwords from a clean device, enable multi-factor authentication, and remove unknown forwarding rules and connected devices.
4. Preserve evidence. Save the fraudulent emails with full headers, the invoices, the bank advice and any WhatsApp messages. Do not delete or reset anything.
5. Inform your IT team or a forensic expert to take a mailbox log and a copy of affected devices.
6. Report to CERT-In. Covered entities are expected to report specified incidents within six hours of noticing them, and partial information can be sent first.
7. Alert vendors and clients whose email may also be affected, so they do not pay the same criminal.

Do not wait for an internal inquiry to finish before calling the bank and 1930.

Cyber Crime Complaint in Delhi, Step by Step

A proper cyber crime complaint in Delhi for corporate fraud should be filed in more than one place:

1. Helpline 1930 and cybercrime.gov.in. File the complaint with transaction IDs, account numbers and the fraudulent emails. Keep the acknowledgement number.
2. Delhi Police cyber units. Delhi has a Cyber Police Station in each police district, and the IFSO unit handles larger and complex cyber cases. High-value corporate frauds are usually investigated here.
3. FIR. For serious frauds, insist that an FIR is registered, naming the sections under the BNS and IT Act that match your facts. Delhi Police also registers e-FIRs for cyber financial fraud above a threshold.
4. Written complaint to the bank. Ask the bank in writing to freeze the beneficiary accounts and share the transaction trail with the police.
5. Complaint to your regulator or CERT-In, where your sector or the CERT-In Directions require it.
6. If the police do not act, send a written complaint to the senior police officer of the district and, if needed, approach the Magistrate under the Bharatiya Nagarik Suraksha Sanhita, 2023.

An officer of the Delhi Police’s IFSO unit has said that many of these high-value scams are run from outside India. This makes quick reporting and a complete evidence file even more important.

Legal Remedies for Victim Companies

The legal remedies after an email hacking case run on several tracks together:

• Criminal prosecution: An FIR against the unknown fraudsters and any identified account holders, under the BNS and IT Act, with investigation of the money trail.
• Freezing and recovery: Police can request banks to hold funds in the beneficiary accounts, and a court can later release frozen money to the rightful victim through a proper application.
• Bank accountability: Where a bank ignored red flags or delayed action after being told, a written complaint to the bank, the banking ombudsman route and, in suitable cases, legal action can be considered.
• Civil suit for recovery: A suit for recovery of money and damages against identified defendants, and against account holders who received and kept the funds.
• Injunctions and takedown: Orders to restrain misuse of the company’s name, to take down look-alike domains and to preserve evidence.
• Contract and insurance: A review of vendor contracts, who bore the payment risk, and whether a cyber insurance policy covers the loss and its notice period.
• Regulatory compliance: Timely reports to CERT-In and the sector regulator, and a data-breach review under the Digital Personal Data Protection Act where personal data was exposed.

First-hour action matters more than any later remedy. Recovery becomes difficult once money has been moved through several accounts.

How Businesses Can Prevent Email Compromise

Most BEC fraud is stopped by simple, written process, not by expensive tools. Our advice as a cyber advocate in Delhi is to put these in place:

• Call-back rule: Verify any change of bank details or any urgent payment request by phoning a number you already hold, never one from the email.
• Two-person approval for payments above a set limit, with no exception for the MD or CEO.
• Multi-factor authentication on all email, banking and WhatsApp accounts used for work.
• Domain protection: Ask your IT team to set up SPF, DKIM and DMARC for your company domain, and to monitor look-alike domains.
• Mailbox rule checks: Review forwarding rules and connected devices regularly.
• Staff training: Train finance and admin staff to spot urgency, secrecy and unusual file requests, including unknown ZIP or executable files on email or WhatsApp.
• No payments on chat instructions: Payment instructions should come only through the approved channel.
• Vendor onboarding: Keep a verified vendor master list, and require written, signed requests for any change.
• Incident plan: Keep a one-page plan with the bank, 1930, IT, legal and CERT-In contacts, so that nobody wastes the first hour.
• Contracts and insurance: Add cyber-security duties and payment-verification clauses in vendor contracts, and review whether cyber insurance suits your risk.

A written policy also helps legally. If a fraud still occurs, it shows that the company took reasonable care.

Common Mistakes and Questions

These are the mistakes that most often make recovery harder after corporate email hacking:

• Waiting a day or two to “confirm internally” before calling the bank and 1930.
• Replying to the fraudster’s email, or deleting the email thread.
• Resetting laptops or mailboxes before a forensic copy is taken.
• Paying a “recovery agent” who promises to get the money back for a fee. This is often a second fraud.
• Telling no one outside the company, so that vendors keep paying the wrong account.

Can the money be recovered? Sometimes. It depends mainly on how quickly the bank and 1930 are alerted. The earlier the report, the better the chance that funds can still be held.

Is the company liable if its own email was hacked? Liability depends on the contract, the facts and the care taken. A written security policy and prompt reporting help.

Do we have to report to CERT-In? Specified incidents, such as unauthorised access to IT systems or data and phishing, are covered by the CERT-In Directions of 2022 and should be reported within six hours of noticing. Take legal advice on whether your incident qualifies.

Who should file the complaint, the company or the employee? The company should file it through an authorised officer, with the employee who handled the transaction supporting with facts.

Contact Us

If your company is facing business email compromise or corporate email hacking in Delhi and needs guidance on legal remedies, you can reach us here:

• Website: https://cyberadvocateindelhi.in/
• Helpline: +91-8810659872

Disclaimer

This blog is published for educational and informational purposes only. It is not an advertisement or solicitation, and it is not a substitute for legal advice on your specific facts.