Phishing
A fake message that tricks a person into revealing passwords or data, or running harmful software.
Phishing is a trick in which a message pretending to be from someone trusted persuades you to click a link, open a file or share a password or code.
Meaning of Phishing
Phishing is a leading cause of breaches. Staff training, email filtering and multi-factor authentication reduce the risk.
Phishing is social engineering carried out through email, SMS, phone calls, messaging apps or fake websites. The attacker poses as a bank, courier, tax office, senior manager or vendor and creates urgency: an account will be blocked, a parcel is held, a refund is waiting, an invoice is overdue. The victim is steered to a lookalike page that captures credentials, to a file that installs malware, or into approving a payment or sharing an OTP. Variants have names: spear phishing targets one person with researched details, smishing uses SMS, vishing uses calls, and business email compromise imitates executives or suppliers.
Phishing is not a DPDP term, but it is a leading way that personal data is lost. Under Section 8(5) the Data Fiduciary must take reasonable security safeguards to prevent a breach, and Rule 6 points to access control, monitoring and logs, and appropriate technical and organisational measures. Staff awareness, mail filtering and multi-factor authentication are the usual measures against phishing, and a regulator is likely to ask about them after a breach that began with a fake email. Section 8(1) also keeps you responsible when a processor's staff are phished.
A successful phish can create a personal data breach in several ways. A stolen mailbox login may expose customer records. A malicious attachment may start ransomware. A deceived accounts clerk may send a salary file to a stranger. In each, Section 2(u) defines the breach as unauthorised access or accidental disclosure that compromises confidentiality, integrity or availability, and Section 8(6) with Rule 7 would then call for intimation to the Board and affected individuals, with a detailed report within 72 hours.
Phishing also affects individuals as Data Principals, because scammers use leaked personal data to make their messages convincing. A caller who knows your name, account type and recent transaction seems legitimate. That is one reason data minimisation and breach prevention matter: less data in circulation means fewer convincing lures. Phishing is different from credential stuffing, which replays old passwords automatically, and from an insider threat, which starts inside the organisation.
Examples of Phishing
An HR employee clicks a fake "salary revision" email and gives away her login.
An HR executive receives a "policy update" email asking her to log in to view a new payroll schedule. The fake page captures her password. Because MFA is on, the attacker is blocked, and the alert she raises leads to a forced password reset.
Customers of a lending app receive an SMS with a lookalike link asking them to update KYC. The company warns users through the app, takes the fake domain down through its registrar, and advises customers to report to the national cybercrime portal.
A start-up founder gets an email from a "supplier" with new bank details. The accounts assistant follows the rule to call the supplier on the number already on file, discovers the fraud and prevents a ₹6 lakh transfer.
Why Phishing matters
One careless click can undo years of security investment, since the attacker arrives with valid credentials and passes through the front door. Penalty exposure follows the outcome: up to ₹250 crore for failing to maintain reasonable safeguards and up to ₹200 crore for failing to notify a breach. For smaller firms, the larger damage is often payment fraud, downtime and loss of client trust.
The human consequences land on customers and employees: drained accounts, identity theft, fake loan applications and harassment. Preventing phishing is therefore not only an IT task. It is part of respecting the people whose data you hold, and it needs a culture where staff can report a mistaken click quickly without fear.
How it works in practice
- 1Train staff regularly with short, realistic sessions and simulated phishing emails. Teach the pause-and-verify habit: check the sender address, hover over links, and confirm any payment or credential request through a known phone number.
- 2Deploy technical filters. Enable SPF, DKIM and DMARC on your domain, use mail gateways that scan links and attachments, and block risky file types. Keep browsers and endpoints updated with protection that warns about malicious sites.
- 3Turn on multi-factor authentication everywhere, ideally phishing-resistant methods such as hardware keys or app-based prompts with number matching, because one-time codes by SMS can also be phished.
- 4Make reporting easy. Add a one-click "report phish" button or a single mailbox, respond quickly, and reward reporters. When someone clicks, ask them to report at once so you can reset passwords and check logs.
- 5Set approval rules for sensitive actions. Require a second approver and call-back verification for bank detail changes and large payments, and restrict bulk exports of personal data.
- 6Treat confirmed account compromise as a potential breach: assess what data was reachable, log it in the breach register and follow your incident plan.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Relying on a single annual training video. Awareness fades, so use short refreshers and simulations throughout the year.
Blaming staff who click. A punitive approach teaches people to hide mistakes, which delays containment and breach notification.
Trusting a familiar logo or sender name. Display names and logos are easily copied, so verify addresses and use a separate channel for sensitive requests.
Compliance tips
Publish a simple "how we will contact you" page for customers, listing the channels you use and stating that you never ask for passwords or OTPs.
Review mailbox rules and forwarding settings after any suspected compromise, since attackers often hide forwarding rules to keep reading mail.
Individuals who suffer a phishing fraud can report it on the national cybercrime reporting portal or the 1930 helpline, and should tell their bank at once.
Common questions about Phishing
Is phishing covered by the DPDP Act?
The Act does not use the word, but a phishing attack that exposes personal data is a personal data breach under Section 2(u). The fiduciary's duty to take reasonable security safeguards under Section 8(5) and breach intimation under Section 8(6) then come into play.
What should I do if an employee clicks on a phishing link?
Ask them to report immediately without blame. Isolate the device if needed, reset credentials, review logs for suspicious access, and assess whether personal data was reachable. If it was, follow your incident plan and decide on notification under Rule 7.
How can I tell a phishing email from a real one?
Look for urgency, unexpected attachments, mismatched sender domains, and links whose address differs from the displayed text. When in doubt, do not click. Contact the sender through a number or website you already know, not one in the message.