Is Social Engineering the Biggest Security Problem for Indian Firms?

As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.

What does social engineering look like in India in 2026?

Four families, each with a documented Indian example. Executive impersonation, where a cloned voice or deepfake video calls a finance employee and asks for an urgent transfer, which is the pattern SEBI named the Boss Scam in a formal caution to listed companies on 17 July 2026. Institution impersonation, where a fake bank, KYC or regulatory agent asks the customer to read an OTP or approve a collect request. Digital arrest, where a caller claims to be from a law enforcement agency and holds the victim in a fake interrogation, and which produced 21,900 complaints involving over Rs 647 crore in eight months of 2026. And supply-chain impersonation, where a supplier's genuine mailbox is used, or a lookalike domain is used because 41% of India's largest companies have not enforced the strictest DMARC policy, to redirect a payment.

Why do awareness programmes fail to stop it?

Because awareness is delivered as information, while social engineering is an attack on a workflow. A person who has been told about phishing can still comply with a genuine-looking request from a superior, because the request arrives inside a legitimate process and the workplace culture rewards compliance with authority. What changes behaviour is rehearsal: a simulation in which the request is delivered in the real channel, the employee is given a defined procedure, and the outcome is measured and coached. The measurable behaviours that matter are reporting rate, the time from first contact to internal escalation, and the percentage of payment requests that were verified out of band. Click rate is a weak metric by comparison, because a click is survivable and a silent compliance is not.

Which verification policies actually stop executive impersonation?

Four, and they are policy rather than technology. Out-of-band callback: any request that changes payment details is confirmed using a number from a directory or a prior invoice, never the one in the request, because attackers with device access save their own number in the victim's contacts under the CEO's name. Dual authorisation: no individual can release a transfer above a threshold, and the second approver is not in the same chat thread. Cooling-off: a new beneficiary or a changed bank account is held for a defined interval, which alone defeats a large share of these attacks. And a change freeze on privileged actions: adding a new payee, enrolling a new device, or raising a payment limit requires the person to be physically present or to authenticate in person. These are cheap, they are auditable, and they are the difference between a 30-second request and an impossible one.

How should an organisation test its exposure to social engineering?

Run it as a measured exercise, not as a surprise. Agree the rules of engagement in writing first, including which channels may be used, that no real customer data is touched, and that no credential is actually captured on a live page. Cover more than one vector, because a WhatsApp or SMS campaign tests something different from an email one, and include a voice or video scenario if the business pays approvals. Then report by department, with a coaching plan for anyone who submitted a credential, and a written set of policy changes. At AAVETech this is fixed-price at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, delivered in 5 to 10 working days with a retest of the failed controls included.

What are the common questions about S?