Attack Vectors and Threat Overview

Cyber attackers exploit multiple vectors to breach data held by banks, telecom providers, social media platforms, and other networks. The sections below describe the most common methods.

1 Common Attack Vectors

• Social engineering (phishing, smishing, vishing): Fraudsters craft deceptive email, SMS, or WhatsApp messages that appear to come from banks or authorities. These messages urge victims to click links or share OTPs and passwords. CERT-In reports a surge in sophisticated phishing that leverages stolen credentials to bypass two-factor authentication. RBI advisories warn that scammers pose as officials, sometimes claiming to be RBI staff, and offer lottery winnings or technical support before asking for OTPs or account details.
• Malware and ransomware: Attackers deliver trojans or ransomware through email attachments, malicious apps, or compromised websites. Once installed, malware can log keystrokes, access contacts, or encrypt data for ransom. Unexpected app behaviour or a locked device are common warning signs.
• Data breaches and hacking: Attackers target company databases at banks, telecom firms, and social platforms through unpatched vulnerabilities or insider collusion. Recent global breaches have exposed millions of user records. No confirmed mass breach of Aadhaar databases has been made public in India, but claims of leaked personal IDs still illustrate the risk.
• Account takeover (SIM swap or OTP theft): Scammers hijack mobile numbers or email accounts to intercept OTPs and enable fraudulent transactions. SIM-porting attacks are rising worldwide and often involve bribing telecom employees or socially engineering customer support staff. Victims typically notice a sudden loss of phone service or alerts about unauthorised logins.
• Impersonation and deepfakes: AI tools can now clone voices and faces convincingly. Attackers use this capability in several ways: vishing calls that mimic family members or officials to request money; video deepfakes that show people saying or doing things they never did, which can defame or blackmail victims; and identity cloning, where AI apps stitch together image snippets to build fake social media profiles. In September 2025, the Delhi High Court issued an injunction that protected actress Aishwarya Rai Bachchan from AI chatbots and videos that imitated her in explicit content.
• Fake apps and phishing platforms: Attackers build fake apps or clone banking and UPI apps to steal credentials. They also spread malicious links through WhatsApp, Telegram, and other messaging apps.
• Network attacks (man-in-the-middle, public Wi-Fi): On unsecured Wi-Fi, attackers can intercept data in transit. Fake hotspots that impersonate legitimate networks, such as “Free Bank WiFi”, lure unsuspecting users. Browser warnings or repeated authentication loops are common indicators.
• Supply-chain attacks: Attackers infiltrate software libraries or vendors to spread malware at scale. CERT-In notes that third-party breach risk continues to escalate, even though specific cases fall outside the scope of this report.

2 Real-World Breach Examples

• In 2025, phishing overtook malware as the leading initial attack method in India. CERT-In’s Digital Threat Report found that stolen credentials and information-stealing malware remain among attackers’ most effective tactics.
• RBI data shows a rise in UPI-related fraud. Fintech analysts estimate that digital payment fraud cost Indians roughly ₹22,845 crore in 2024.
• India’s National Cyber Crime Reporting Portal (cybercrime.gov.in) logs thousands of financial and social media scams every year. Government advisories highlight NPCI’s use of device binding and AI/ML-based monitoring to curb fraud.
• On child safety, NCMEC recorded 4,700 reports of AI-generated child sexual abuse material in 2023, showing how deepfakes enable disturbing new forms of harm.

These examples show that attackers now blend traditional methods, such as phishing and hacking, with AI enhancements. This combination makes threats more convincing and harder to detect.

3 Attack Vectors vs. Indicators vs. Mitigations

Each mitigation above adds a layer of defence. CERT-In and RBI recommend two-factor authentication everywhere as a basic safeguard, and banks often cap high-value transactions. Regular security awareness training remains critical, since human error is still the primary weakness.

4 Advanced Controls for Organisations

• Web application firewalls (WAFs) block malicious traffic before it reaches internal systems.
• Network segmentation and Zero Trust architectures limit an intruder’s ability to move laterally.
• Threat intelligence and monitoring, including the AI/ML anomaly-detection tools NPCI uses, catch problems early.
• Bug bounty and responsible-disclosure programmes help teams find vulnerabilities before attackers do.
• Regulatory compliance audits confirm that technical safeguards and policies satisfy data-protection law.

By combining technology, awareness, and policy, individuals and organisations can significantly reduce their exposure to these attack vectors.

Legal and Regulatory Framework

India’s legal regime is evolving quickly to address digital threats. This section outlines the key laws and judgments, and compares them with international standards.

1 Indian Laws and Case Law

Information Technology Act, 2000

The IT Act remains India’s primary cyberlaw. Section 66C punishes identity theft by personation, meaning the use of another person’s identity to cause harm. Section 66D punishes cheating by personation through a communication device. Section 72A criminalises a body corporate’s breach of confidentiality or privacy of personal data. Section 67B penalises publishing private images or videos without consent. Section 79 provides safe-harbour rules for intermediaries, as modified by the Shreya Singhal judgment.

Digital Personal Data Protection Act, 2023

The DPDP Act secures the personal data of Indian citizens. It requires data fiduciaries, such as companies, to obtain consent, ensure data security, and notify authorities and affected individuals after a breach. The Act borrows heavily from GDPR principles. Because the law is still new, the government will flesh out further detail through rules, but it already reflects the global trend toward stronger data protection.

Bharatiya Nyaya Sanhita, 2023

The BNS forms part of the criminal-law overhaul that took effect in 2024 and modernises cybercrime offences. It consolidates hacking, identity theft, phishing, ransomware, deepfake dissemination, and online child exploitation under a single chapter. Researchers note that the BNS explicitly recognises online fraud, identity theft, phishing, cyberstalking, digital impersonation, and deepfake misuse. This clarity means digital forms of traditional crimes, such as cheating and defamation, now have codified definitions, although readers should verify the final sections in the official text.

Constitutional Case Law

• Justice K.S. Puttaswamy (Retd.) v. Union of India (2017): A nine-judge bench affirmed that the right to privacy is an intrinsic part of the right to life and personal liberty under Article 21. This judgment now underpins every privacy and digital-rights debate in India.
• Shreya Singhal v. Union of India (2015): A two-judge bench struck down Section 66A of the IT Act, which criminalised offensive online speech, as vague and unconstitutional. The Court also read down Section 79 to protect intermediaries from automatic liability and required that takedown orders rest on a legal basis. The ruling established that online regulation must be narrowly tailored.
• Other judgments: Several High Courts have also weighed in; for example, the Kerala High Court affirmed privacy rights for internet usage. The 2025 Bachchan deepfake cases emphasised personality rights, with the Delhi High Court granting interim injunctions and noting that unauthorised exploitation of a person’s image through AI deepfakes causes irreparable harm. These rulings reflect an expanding judicial recognition that digital impersonation and deepfake misuse infringe on dignity and reputation.

Together, these laws and precedents form a framework for prosecuting wrongdoing and protecting victims. For example, someone who shares non-consensual, AI-generated intimate images could face charges under Section 67B of the IT Act, and related content restrictions may fall under IPC offences such as defamation or insult by word or deed. The BNS reforms will further clarify these penalties and definitions.

Key Statutory Highlights

• Right to privacy: A fundamental right under Article 21. Any law that curbs data use must meet strict constitutional tests.
• IT Act offences: Identity theft (Section 66C), impersonation (Section 66D), privacy breach (Section 72A), abusive content (Section 67B), and unauthorised access (Section 66).
• DPDP Act: Sets out data fiduciaries’ obligations, including consent, purpose limitation, security safeguards, and mandatory breach reporting.
• BNS 2023: Folds digital-era crimes, such as online cheating, phishing, and deepfakes, into general criminal law.

2 International Laws and Standards

• EU General Data Protection Regulation (GDPR): This landmark regulation, effective since 2018, sets strict data-protection rules. It requires breach notification within 72 hours and allows fines of up to 4% of global turnover for negligence. India’s DPDP Act adopts similar principles, including consent-based processing, data minimisation, and access and erasure rights, and GDPR’s enforcement record shows how much liability companies can face after a breach.
• EU AI Act (proposed): Though still under negotiation, the Act takes a risk-based approach and bans unacceptable AI uses, such as manipulative deepfakes and social scoring. High-risk AI, such as facial recognition, faces strict requirements, and even low-risk generative AI must meet transparency standards, including deepfake watermarking. The Act offers a useful model for future Indian AI regulation: accountability for AI systems, safety-by-design safeguards, and mandatory incident reporting.
• Other frameworks: The OECD’s AI Principles stress responsibility and incident monitoring. UNESCO and the G7 have also called for ethical AI norms, including transparency, human oversight, and standardised incident reporting.

3 Comparison of Legal Provisions

Defensive Measures and Best Practices

Protecting personal data and identity requires a layered approach that combines technical safeguards, user vigilance, and clear policy. The sections below set out recommended practices for different stakeholders.

1 Technical Controls

• Strong authentication: Use multi-factor authentication on every critical account, including banking, email, and social media. RBI plans to soon require two dynamic factors, such as biometrics plus a PIN, for digital payments, and RBI and NPCI already promote device binding and AI/ML transaction monitoring.
• Encryption: Secure data at rest and in transit. Banks and telecom operators should use end-to-end encryption for customer data, and individuals should choose encrypted messaging apps and email where possible.
• Regular updates and patches: Keep operating systems, banking apps, browsers, and antivirus software up to date, since unpatched devices remain prime targets for breaches.
• Secure networks: Use WPA3 or WPA2 on home Wi-Fi, and use a VPN on public networks. Never share passwords or OTPs over an insecure connection.
• Web and email filters: Organisations should deploy firewalls, DNS filtering, and secure email gateways to catch phishing and malware before it reaches users.
• Incident detection tools: Anti-malware and intrusion-detection systems can flag anomalous activity, such as unauthorised logins or unusual transactions. NPCI’s AI-based fraud monitoring illustrates this approach at national scale.

2 Behavioural and Policy Measures

• Training and awareness: Educate family members, especially children and seniors, about recognising scams. Children should learn never to share personal information or images with strangers online, and NCMEC stresses that adults must guide young people on safe AI use and the dangers of deepfakes.
• Privacy hygiene: Limit the personal data you share on social media and review your privacy settings regularly, since cybercriminals often mine public profiles to craft targeted attacks.
• Verification habits: Always verify unexpected requests independently. If a caller claiming to be a bank executive asks for an OTP or login details, hang up and call the bank’s official number. As the RBI puts it, no bank or the Reserve Bank will ever call to ask for passwords or OTPs.
• Incident reporting: Report fraud promptly through the National Cyber Crime Reporting Portal (cybercrime.gov.in) or the 1930 helpline. Under current CERT-In rules, banks and companies must report breaches within six hours, and the DPDP Act will add further notification duties for affected users.
• Data minimisation: Organisations should collect only the personal data they truly need and delete it once it is no longer required. This principle, which the DPDP Act embodies, reduces the impact of any future breach.
• Backup and recovery plans: Back up important data offline on a regular basis. Businesses should maintain tested disaster-recovery plans, and individuals should keep backups on external drives or a secure, 2FA-protected cloud service so they can recover from ransomware without paying.

3 Attack Vectors vs. Mitigation: Key Controls

Security is not one-size-fits-all: measures should scale with risk. High-profile individuals and financial institutions need the strictest controls, while everyday users should start with the basics: strong passwords, two-factor authentication, and everyday vigilance.

Incident Response and Evidence Preservation

A quick, well-organised response can limit the damage after a breach. The critical steps are detection, containment, and documentation.

1 Immediate Actions and Reporting

• Identify and isolate: Once you notice a breach or suspicious activity, such as an unexpected transaction or an erratic device, isolate the affected system by disconnecting it from the network. Avoid powering it off abruptly if forensic analysis may be needed.
• Report early: Indian law requires organisations to report cyber incidents to CERT-In within six hours of noticing them. Individuals should report incidents to the national cybercrime portal (cybercrime.gov.in) and to local police, and the government’s Chakshu platform allows citizens to report fraudulent calls and SMS. Early reporting helps block fraudsters and warn others.
• Contact stakeholders: Businesses should notify customers, partners, and regulators as required, including RBI reporting for banking fraud. Under the DPDP Act, data fiduciaries will need to notify both the regulator and affected individuals, likely within a short timeframe.

2 Forensics and Chain of Custody

• Preserve logs and evidence: Take screenshots of suspicious messages or transaction records, and save device logs, call records, and chat histories. Preserve full email headers, and do not delete any data.
• Document the timeline: Write down what happened and when, including the dates and times of suspicious calls or login alerts. This log proves invaluable during any investigation.
• Maintain chain of custody: When handing devices or data to law enforcement, keep a clear record of who collected the evidence, when, and how it was stored. This record ensures the evidence remains admissible in court.
• Engage experts: Larger incidents often require professional cyber-forensic analysis from CERT-In or an empanelled agency. The Bharatiya Sakshya Adhiniyam 2023, India’s new evidence law, sets out rules for certifying and analysing digital evidence.

3 Incident Response Timeline

A typical incident response plan moves through seven phases, each building on the last.

• Detection and identification: A user reports an event, or a monitoring system raises an alert.
• Reporting: The organisation notifies CERT-In, as Section 70B of the IT Act requires, and contacts law enforcement.
• Containment: The team isolates systems and blocks affected accounts to prevent further damage.
• Eradication: The team removes malware and compromised credentials, then patches the underlying vulnerability.
• Forensic investigation: Analysts reconstruct what happened and preserve evidence using forensic tools.
• Recovery: The team restores data from backups and re-enables services securely.
• Post-incident review: The organisation reviews the incident, updates its policies, and retrains staff to improve future defences.

4 Key Incident Response Tips

• Do not delay: Time matters. RBI advisories note that victims often discover fraud only after days or weeks, which makes recovery harder. Acting immediately can qualify a victim for partial refunds under RBI’s newer guidelines.
• Use designated channels: In India, the CERT-In helpline and portal, the cybercrime portal, the 1930 helpline, and specialised police cyber cells all handle these incidents.
• Collaborate: Organisations should cooperate closely with CERT-In and law enforcement. Indian courts, for example, have ordered platforms such as Google to disclose user logs and details in deepfake cases.

Recommendations for Stakeholders

Strengthening India’s cyber resilience requires coordinated action from every stakeholder group.

• Individuals: Stay informed by following CERT-In advisories, practise good cyber hygiene through strong passwords and 2FA, and educate family members. Use official apps and double-check messages before acting on them.
• Families and educators: Include digital literacy in school curricula, and teach children about phishing, privacy, and the permanence of online actions. Parental controls and open dialogue both matter.
• Businesses: Adopt security-by-design principles, run regular audits and penetration tests, and develop clear incident response plans. Train employees on cyber threats, and financial firms should proactively follow RBI and NPCI security guidelines, including device binding and strong KYC.
• Technology companies: Build safety measures directly into products, such as AI tools that detect deepfakes or child-abuse content on social platforms. Offer user-friendly privacy controls, and follow the OECD’s AI due-diligence recommendations to prevent misuse.
• Policymakers: Strengthen enforcement of the DPDP Act by establishing a capable regulator. Enact an AI governance framework, modelled on the EU’s risk-based approach, to regulate deepfakes and AI-generated content. Enhance cross-border cooperation, since cybercrime often involves overseas servers, and consider ratifying international conventions such as the Budapest Convention. Launch nationwide awareness campaigns, such as a “Know Your Digital Rights” drive, and invest in cyber-forensic capacity.
• Law enforcement: Train more cybercrime investigators, and maintain quick-support channels such as the 1930 helpline and dedicated cyber cells. Streamline the process of taking down malicious content in partnership with technology platforms.