Knowledge base · Cyber fraud
What is phishing?
Short answer
Phishing is a form of social engineering in which a fraudster impersonates a trusted person or organisation, by email, SMS, phone call, messaging app or fake website, to trick the victim into revealing credentials or payment details, installing malware, or authorising a payment. It is the most common entry point for cyber fraud and account compromise.
Definition of Phishing (also: spear phishing, smishing, vishing, whaling, credential phishing)
Phishing is the use of deception to get a person to do something that benefits the attacker, such as entering a password on a fake login page, opening an infected attachment, sharing a one-time password or approving a payment. The attacker borrows the identity of someone the victim trusts: a bank, a tax authority, a courier company, a colleague or the CEO.
The term covers several channels:
- Email phishing: links to fake login pages or malicious attachments.
- Smishing: fraudulent SMS, often about KYC expiry, parcels or electricity bills.
- Vishing: voice calls impersonating banks, telecom providers or officials.
- Messaging-app phishing: WhatsApp or similar messages from "colleagues" or "relatives".
- Spear phishing and whaling: researched messages aimed at specific employees or executives.
How does a phishing attack work?
Most attacks follow the same pattern. The fraudster creates a pretext (an urgent payment, a locked account, a legal notice), uses a lookalike sender or domain, and pushes the victim to act before thinking. The goal is usually one of three things: credentials, money, or a foothold on a device.
Stolen credentials are often the start of a longer scheme. A compromised mailbox can be used for business email compromise, and stolen banking credentials or OTPs lead to account takeover.
What does Indian law say about phishing?
There is no single "phishing" offence, but the conduct is covered by several provisions:
- IT Act 2000, s. 66C (identity theft): fraudulent or dishonest use of another person's electronic signature, password or other unique identification feature, punishable with up to three years and a fine up to INR 1 lakh.
- IT Act 2000, s. 66D (cheating by personation using a computer resource): up to three years and a fine up to INR 1 lakh.
- Bharatiya Nyaya Sanhita 2023: cheating under s. 318, and cheating by personation under s. 319.
On the reporting side, the CERT-In Directions of 28 April 2022 list "identity theft, spoofing and phishing attacks" among incidents that covered entities must report within six hours. Victims of financial fraud can report on the 1930 helpline or the National Cybercrime Reporting Portal at cybercrime.gov.in.
RBI has also acted on lookalike domains. Its circular of 22 April 2025 required banks to migrate to the exclusive ".bank.in" domain no later than 31 October 2025, giving customers a simple check on whether a banking website is genuine.
Red flags of phishing
- Urgency or threats: "account will be blocked today", "legal action pending".
- Sender addresses or domains that differ slightly from the real one.
- Requests for OTPs, passwords, PINs or remote-access apps.
- Links whose destination does not match the displayed text.
- Unexpected attachments, invoices or changes to payment instructions.
- Requests to keep the matter confidential or bypass normal approval.
How do organisations investigate a phishing incident?
An investigation usually establishes who received and clicked the message, what credentials or data were exposed, whether mailbox rules or forwarding were created, and whether money moved. This relies on email header analysis, mailbox and sign-in logs, endpoint artefacts and, where needed, forensic imaging of affected devices. Log preservation matters: the CERT-In Directions require ICT system logs to be kept for a rolling 180 days within India.
How does phishing differ from related frauds?
Phishing is the technique; other frauds are what it enables. Business email compromise uses a compromised or spoofed mailbox to divert payments. Account takeover is the misuse of a hijacked account. A digital arrest scam is an extended form of vishing in which callers pose as law-enforcement officers.
Our digital forensics and eDiscovery service covers incident evidence collection and analysis. For what to do once a mailbox has been compromised, see business email compromise: the first 48 hours.
Frequently asked questions
Do companies in India have to report phishing attacks?
The CERT-In Directions of 28 April 2022 list identity theft, spoofing and phishing attacks among the incident types that service providers, intermediaries, data centres, body corporates and government organisations must report to CERT-In within six hours of noticing them. Other reporting duties, for example to a bank, regulator or the police, may also apply depending on the facts.
What should an individual do after falling for a phishing message?
Act quickly. Contact the bank to block cards or accounts, change passwords and enable stronger authentication, and report the fraud on the 1930 helpline or at cybercrime.gov.in. Prompt reporting matters because RBI rules on customer liability for unauthorised electronic transactions depend partly on how quickly the customer informs the bank.
How is spear phishing different from ordinary phishing?
Ordinary phishing is sent in bulk, hoping a small share of recipients respond. Spear phishing targets a specific person or team using researched details such as names, roles, suppliers or ongoing deals, so the message looks credible. Whaling is spear phishing aimed at senior executives. Targeted attacks are harder to spot and often precede business email compromise.
Sources
Go deeper
Related insights
Cyber fraud29 Sept 2026
Account Takeover and SIM-Swap Fraud: Detection and Response for Indian Businesses
How account takeover and SIM-swap fraud work, the signals that expose them, and what RBI liability rules and the IT Act mean for Indian businesses.
Cyber fraud26 Sept 2026
Digital Arrest Scams: How They Work and How Organisations Can Protect Their People
A ‘digital arrest’ is a scam, not a legal process. How the fraud works, what Indian authorities advise, and how employers can protect their staff.
Cyber fraud23 Sept 2026
Business Email Compromise: How It Happens and What to Do in the First 48 Hours
How business email compromise works and a 48-hour response plan for Indian companies: call the bank, report on 1930, assess CERT-In reporting, preserve logs.