Phishing in India 2026: why it still works, business email compromise, AI-written scam mail, the strict DMARC gap, and how to run a measured staff simulation.
Phishing still works in India because it targets behaviour rather than technology, and because most organisations have not closed the two doors that make it valuable. The first is the mailbox: 41% of India's largest companies have not enforced the strictest DMARC policy, so a lookalike domain can impersonate a supplier or a bank. The second is the person: a finance employee asked to make an urgent transfer will often do it. In 2026 the writing quality is no longer the giveaway, because phishing-as-a-service uses language models, and the tell is the request, not the grammar.
Because the training is usually generic and the attack is specific. A session that explains what phishing looks like teaches people to look for spelling, and the 2026 attacks no longer offer that. Phishing-as-a-service operations now use language models to write bespoke, business-specific messages referencing real projects, real supplier names and real internal jargon, so the grammar is clean and the context is accurate. What remains constant is the shape of the request: urgency, a payment, a new beneficiary, a credential reset, or an unexpected file. Indian compounding is that a genuine business culture of deference makes an instruction from a senior figure persuasive, which is exactly the pattern SEBI named in its 17 July 2026 caution on the Boss Scam, where AI voice cloning and deepfake video calls were paired with a compromised WhatsApp session.
It is the variant where the email contains no malicious code at all. The attacker either steals a real mailbox or spoofs one, and then simply writes to your finance team asking for a transfer, a change of beneficiary account or the release of a payment document. Nothing is detonated, so nothing is caught by a sandbox, and the loss is the direct transfer. India's numbers make the scale clear: over Rs 22,800 crore was lost to telecom fraud and impersonation scams, and SEBI's caution followed two Indian companies that lost nearly Rs 3.5 crore after employees opened malicious files sent by apparent senior colleagues. BEC also has a second cost, because the mailbox that was used is often still in the attacker's hands, and the follow-on invoice fraud continues after the first payment.
Seven, and they are not all training. Enforce DMARC at reject rather than monitor, and publish the policy, because 41% of India's largest companies have not done it. Put a banner on external mail that flags lookalike domains, and warn specifically on a first-time sender or a first-time recipient. Require multi-factor authentication that resists phishing, which means a passkey or a hardware security key, because SMS and push approvals can be approved by the attacker. Give the finance team a mandatory out-of-band callback for every beneficiary change, and a cooling-off period. Separate invoice submission from invoice approval. And instruct the team never to read an OTP or a PIN to anyone. Training sits on top of these, and it is the least effective item on the list when it is a lecture.
By running simulations and reporting numbers, not by attendance at a session. A useful programme runs a small number of realistic campaigns a quarter, covers more than one vector including SMS and WhatsApp, tracks click rate and, more importantly, credential submission rate and reporting rate, and gives immediate coaching to anyone who submitted a credential. The target is not zero clicks, it is a rising report rate, because a workforce that reports within minutes limits the damage regardless of whether it clicks. At AAVETech the engagement is fixed-price at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, delivered in 5 to 10 working days with a written report and a retest of the failed controls included.
| Control | Effectiveness | Why |
|---|---|---|
| DMARC at reject | High | Removes lookalike-domain spoofing at the receiver |
| Phishing-resistant MFA | High | A proxied login page cannot capture a passkey |
| Out-of-band callback on payments | High | Defeats the request, which is the actual payload |
| External mail banner | Medium | Catches a near-miss domain at the point of reading |
| Awareness simulation | Medium | Builds reporting habit and measures susceptibility |
| Annual awareness training | Low | Decays quickly and is rarely measured |
Phishing still works in India because it targets behaviour rather than technology, and because most organisations have not closed the two doors that make it valuable. The first is the mailbox: 41% of India's largest companies have not enforced the strictest DMARC policy, so a lookalike domain can impersonate a supplier or a bank. The second is the person: a finance employee asked to make an urgent transfer will often do it. In 2026 the writing quality is no longer the giveaway, because phishing-as-a-service uses language models, and the tell is the request, not the grammar.
No. Phishing-as-a-service operations use language models to produce clean, business-specific writing with accurate context, so typos and grammar are no longer the signal. Look instead at the request: urgency, a payment, a new beneficiary, a credential reset or an unexpected file, especially with a lookalike sender domain.
DMARC is a policy that tells receiving mail servers what to do with mail claiming to come from your domain, and enforcing it at reject stops a spoofed lookalike domain reaching a customer or supplier. 41% of India's largest companies have not enforced the strictest policy, which is why supplier invoice fraud remains effective in India.
Yes, and consent and framing matter. Tell staff the programme exists, use realistic but harmless lures, never collect real credentials on a live page, and give immediate coaching rather than punishment. Track reporting rate alongside click rate, because reporting is the behaviour that actually limits damage.
Enforce DMARC at reject, alert on the first outbound email to a new external recipient, disable automatic forwarding, review the full-access grant list, and require a second factor that resists proxying. Also monitor for the pattern SEBI described in July 2026, where malware hijacks a genuine WhatsApp Web session to issue instructions from a real internal account.
At AAVETech phishing simulation and awareness engagements are fixed-price at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, with a 5 to 10 working day turnaround, a written report and a retest of the failed controls included.
Read the full guide on AAVETech: Why Does Phishing Still Work on Indian Organisations?.
Send us your current email security posture and we will return a fixed-price phishing simulation scope with a written rules of engagement.
Talk to an analyst about this.