India's Phishing Epidemic
Phishing is the #1 initial attack vector for data breaches in India. With over 900 million internet users and rapidly growing digital adoption, Indian businesses and individuals face an unprecedented volume of phishing attacks.
79%Of Indian data breaches started with phishing (Verizon DBIR 2025 — APAC)
1.7 MnPhishing URLs targeting Indian entities blocked in 2025 (CERT-In)
₹1,200 CrLosses from BEC/phishing scams in India in 2025 (RBI Fraud Report)
91%Of cyberattacks begin with a phishing email (Proofpoint 2025)
Most Common Phishing Patterns in India
1. UPI and banking phishing
graph TD
A[📱 SMS: Your UPI
is being deactivated] --> B[🔗 Link to fake
bank login page] B --> C[🔑 Victim enters
credentials + OTP] C --> D[💸 Attacker initiates
real-time transaction] style A fill:#1e3a5f,stroke:#F97316,color:#e2e8f0 style D fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0
is being deactivated] --> B[🔗 Link to fake
bank login page] B --> C[🔑 Victim enters
credentials + OTP] C --> D[💸 Attacker initiates
real-time transaction] style A fill:#1e3a5f,stroke:#F97316,color:#e2e8f0 style D fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0
2. Tax/IT department phishing
- "Your ITR refund of ₹15,245 is pending" — links to fake Income Tax portal
- Peaks during July-September (ITR filing season)
- Uses domains like
incometax-gov-refund.com
3. KYC update scams
- "Your KYC is expiring. Update now to avoid account freeze"
- Targets bank, mutual fund, and mobile customers
- Asks for PAN, Aadhaar, and bank details
4. Invoice fraud
- Attacker sends fake invoices from compromised vendor email accounts
- Commonly targets accounts payable teams
- Average loss per incident: ₹12 lakh
5. CEO/CFO impersonation
- Attacker spoofs or compromises executive email
- "Transfer ₹X to this vendor immediately — urgent"
- Works because of hierarchical Indian business culture
Phishing Statistics by Industry in India
| Industry | Phishing Attempts (Monthly Avg) | Click-Through Rate | Top Lure |
|---|---|---|---|
| Banking & Finance | 2.4 lakh | 12% | KYC/UPI deactivation |
| E-commerce | 1.8 lakh | 18% | Order confirmation/refund |
| IT Services | 1.2 lakh | 8% | Microsoft 365 login |
| Healthcare | 0.6 lakh | 22% | ABHA/Ayushman card |
| Government | 0.4 lakh | 15% | Aadhaar/PAN update |
WARNING
Healthcare has the highest click-through rate at 22%. If you're a healthtech startup or hospital with digital services, phishing training is critical.
Know your vulnerabilities before attackers do
Run a free VAPT scan — takes 5 minutes, no signup required.
Book Your Free ScanBuilding a Phishing-Resistant Organisation
Technical controls
| Control | What It Does | Effectiveness |
|---|---|---|
| SPF record | Declares which servers can send email for your domain | Prevents basic spoofing |
| DKIM signing | Cryptographically signs outgoing emails | Proves email authenticity |
| DMARC policy | Tells receivers what to do with failed SPF/DKIM | Stops spoofed emails |
| Email filtering | AI-based detection of phishing content | Catches 95%+ of phishing |
| URL rewriting | Rewrites links to go through security proxy | Blocks malicious links |
| MFA | Second factor beyond password | Renders stolen creds useless |
Process controls
- Verification protocol for financial requests — Any payment request over ₹50,000 requires verbal confirmation via a known phone number
- Separate approval for new vendor bank details — Never update vendor payment details from an email alone
- Look-alike domain monitoring — Monitor for domains similar to yours (e.g., bachao-ai.com, bachao.in)
Human controls
- Monthly phishing simulations — Send fake phishing emails to your own team and track who clicks
- 5-minute security huddles — Weekly quick discussion of the latest phishing attempt someone spotted
- Reward reporting — Praise employees who report phishing, never punish those who fall for simulations
Key Takeaway
Technical controls + human awareness = best defence. SPF/DKIM/DMARC stops email spoofing at the protocol level. MFA renders stolen credentials useless. And regular training makes your team the last line of defence.
Check Your Email Security Now
You can check your domain's email security setup right now:
bash
# Check SPF record
dig TXT yourdomain.com | grep "v=spf1"
# Check DKIM
dig TXT selector._domainkey.yourdomain.com
# Check DMARC
dig TXT _dmarc.yourdomain.comTIP
If any of these return empty, your domain is vulnerable to email spoofing. A VAPT scan from Bachao.AI includes email security assessment and will flag missing SPF/DKIM/DMARC configurations.
Protect Your Business
INFO
Email security is part of every Bachao.AI VAPT scan. Book a free scan to check your email authentication setup alongside your web application security.
Written by Shouvik Mukherjee, Founder of Bachao.AI. Follow me on LinkedIn for phishing alerts and cybersecurity insights for Indian businesses.
