Phishing is the most common cyber attack vector worldwide. Over 90% of successful data breaches start with a phishing email. Attackers impersonate trusted entities — your bank, a government agency, a colleague, a vendor — to trick you into revealing credentials, clicking malicious links, or transferring money.
Types of Phishing Attacks
Email phishing: Mass emails sent to thousands of addresses, impersonating well-known brands. These cast a wide net and rely on volume — even a small success rate is profitable.
Spear phishing: Targeted attacks aimed at specific individuals using personal information gathered from LinkedIn, social media, or previous breaches. Far more convincing and dangerous than generic phishing.
Whaling: Spear phishing that targets C-suite executives and senior management. These attacks often involve fake legal notices, board communications, or high-value wire transfer requests.
Smishing and vishing: Phishing via SMS (smishing) or voice calls (vishing). Common in India — fake KYC update messages from “banks,” fraudulent OTP requests, and calls impersonating income tax or TRAI officials.
Clone phishing: The attacker copies a legitimate email you previously received, replaces the attachment or link with a malicious version, and resends it — often claiming it is an updated version.
Red Flags to Watch For
Urgency and fear: “Your account will be suspended in 24 hours.” “Immediate action required.” Legitimate organisations rarely demand instant action via email.
Sender address mismatches: The display name says “State Bank of India” but the email comes from sbi-alerts@random-domain.com. Always check the actual email address, not just the display name.
Generic greetings: “Dear Customer” or “Dear User” instead of your actual name. Your bank knows your name.
Suspicious links: Hover over links before clicking. If the URL does not match the claimed sender’s domain, it is phishing. Watch for lookalike domains: amaz0n.com, go0gle.com, statebankofindia.co (missing the “m”).
Unexpected attachments: Especially .exe, .zip, .docm (macro-enabled), or .html files. Even PDF attachments can contain embedded malicious links.
Requests for credentials or OTPs: No legitimate service will ask you to share your password, OTP, or PIN via email or phone. Ever.
Protecting Your Business
Security awareness training: Train every employee — not just IT staff — to recognise phishing. Conduct monthly simulated phishing exercises and track who clicks. Make training supportive, not punitive — shame-based approaches make people hide incidents instead of reporting them.
Email authentication: Configure SPF, DKIM, and DMARC for your domain. These protocols prevent attackers from spoofing your email address to attack your clients, partners, and employees.
Email filtering: Use your email provider’s built-in protection plus an additional email security gateway if budget allows. These catch the majority of phishing emails before they reach inboxes.
Reporting culture: Make it easy and safe to report suspicious emails. A dedicated “Report Phishing” button or email address. Respond to every report — even false positives — to encourage continued reporting.
Verification procedures: Establish out-of-band verification for financial requests. If the CFO emails asking for a wire transfer, call them on a known number to confirm. This single policy prevents the majority of BEC losses.
What to Do If You Fall for Phishing
Act immediately. Change your password on the affected account and any other account using the same credentials. Enable MFA if it was not already active. Report the incident to your IT/security team. If financial information was compromised, contact your bank immediately. Preserve the phishing email as evidence — do not delete it. Monitor your accounts for unusual activity in the following weeks.
