Hyderabad: City-based infrastructure giant Megha Engineering and Infrastructures Ltd (MEIL) has become the victim of an elaborate phishing scam, losing approximately Rs 5.5 crore.
Telangana Police’s Cyber Security Bureau (TGCSB) has registered a case after MEIL discovered that two payments meant for its Dutch vendor, Duiker Combustion Engineers, had been fraudulently redirected.
MEIL had issued a purchase order for burner packages and a work order for a reaction furnace package to the Netherlands-based vendor, with payments made according to the agreed-upon contractual milestones. However, fraudsters impersonated the vendor’s representative and manipulated the payment instructions using a fake email ID. As a result, the funds, instead of being credited to the legitimate ABN Amro Bank account in the Netherlands, were transferred to a fake JP Morgan Chase account in the US.
MEIL initially made legitimate payments to Duiker Combustion through ABN Amro Bank, which were acknowledged by the vendor’s representative, Peter Nuijs, via his official email ID.
However, on Nov 29, 2024, an email allegedly from Nuijs—using the address ‘nuijs@duiker.cam’ instead of ‘nuijs@duiker.com’—claimed that the vendor’s original bank account was restricted due to court orders. The email instructed MEIL to make future payments to a new account at JP Morgan Chase in Alpharetta, Georgia, US.
Believing the communication to be genuine, MEIL transferred two payments in Jan 2025. On Jan 24, an amount of €3,18,000 (Rs 2.87 crore) was sent, and on Jan 29, another €2,89,800 (Rs 2.6 crore) was transferred.
Upon seeking confirmation from Duiker Combustion, the vendor confirmed on Feb 4 and 5 that they had not received the payments. The discrepancy led to an internal review, which revealed that unknown individuals had impersonated Nuijs and altered the email domain to mislead MEIL.
MEIL filed a police complaint on Feb 13. Based on it, TGCSB officer KVM Prasad registered the case under sections 318(4), 319(2), and 338 of Bharatiya Nyaya Sanhita (BNS), along with sections 66-C and 66-D of IT Act. TGCSB officials are trying to trace the perpetrators.
