Why Does Phishing Still Work on Indian Organisations?
Key takeaways
- 41% of India's largest companies have not enforced the strictest DMARC policy, so a lookalike domain can still impersonate a real supplier.
- Phishing-as-a-service now uses language models to write bespoke, business-specific emails, so writing quality is no longer a reliable tell.
- Business email compromise in India is usually a request, not a payload: a new beneficiary, a changed bank account, an urgent transfer.
- SEBI cautioned listed companies on 17 July 2026 over the Boss Scam, a fraud pattern built on impersonating senior executives.
- Awareness training only works when it is measured, and a simulation with a fixed report is what makes the measurement possible.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
Why does phishing still succeed against trained staff?
Because the training is usually generic and the attack is specific. A session that explains what phishing looks like teaches people to look for spelling, and the 2026 attacks no longer offer that. Phishing-as-a-service operations now use language models to write bespoke, business-specific messages referencing real projects, real supplier names and real internal jargon, so the grammar is clean and the context is accurate. What remains constant is the shape of the request: urgency, a payment, a new beneficiary, a credential reset, or an unexpected file. Indian compounding is that a genuine business culture of deference makes an instruction from a senior figure persuasive, which is exactly the pattern SEBI named in its 17 July 2026 caution on the Boss Scam, where AI voice cloning and deepfake video calls were paired with a compromised WhatsApp session.
What is business email compromise, and why is it the expensive part?
It is the variant where the email contains no malicious code at all. The attacker either steals a real mailbox or spoofs one, and then simply writes to your finance team asking for a transfer, a change of beneficiary account or the release of a payment document. Nothing is detonated, so nothing is caught by a sandbox, and the loss is the direct transfer. India's numbers make the scale clear: over Rs 22,800 crore was lost to telecom fraud and impersonation scams, and SEBI's caution followed two Indian companies that lost nearly Rs 3.5 crore after employees opened malicious files sent by apparent senior colleagues. BEC also has a second cost, because the mailbox that was used is often still in the attacker's hands, and the follow-on invoice fraud continues after the first payment.
Which controls actually reduce phishing success?
Seven, and they are not all training. Enforce DMARC at reject rather than monitor, and publish the policy, because 41% of India's largest companies have not done it. Put a banner on external mail that flags lookalike domains, and warn specifically on a first-time sender or a first-time recipient. Require multi-factor authentication that resists phishing, which means a passkey or a hardware security key, because SMS and push approvals can be approved by the attacker. Give the finance team a mandatory out-of-band callback for every beneficiary change, and a cooling-off period. Separate invoice submission from invoice approval. And instruct the team never to read an OTP or a PIN to anyone. Training sits on top of these, and it is the least effective item on the list when it is a lecture.
How should an organisation measure phishing susceptibility?
By running simulations and reporting numbers, not by attendance at a session. A useful programme runs a small number of realistic campaigns a quarter, covers more than one vector including SMS and WhatsApp, tracks click rate and, more importantly, credential submission rate and reporting rate, and gives immediate coaching to anyone who submitted a credential. The target is not zero clicks, it is a rising report rate, because a workforce that reports within minutes limits the damage regardless of whether it clicks. At AAVETech the engagement is fixed-price at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, delivered in 5 to 10 working days with a written report and a retest of the failed controls included.
| Control | Effectiveness | Why |
|---|---|---|
| DMARC at reject | High | Removes lookalike-domain spoofing at the receiver |
| Phishing-resistant MFA | High | A proxied login page cannot capture a passkey |
| Out-of-band callback on payments | High | Defeats the request, which is the actual payload |
| External mail banner | Medium | Catches a near-miss domain at the point of reading |
| Awareness simulation | Medium | Builds reporting habit and measures susceptibility |
| Annual awareness training | Low | Decays quickly and is rarely measured |
What are the common questions about P?
Get a straight answer on this
Send us your current email security posture and we will return a fixed-price phishing simulation scope with a written rules of engagement.
Send us the details See pricing