Phishing Awareness Training for Employees: Look-Alike Domains, BEC, OTP Fraud and the Law

Phishing awareness training is the cheapest security control an office can buy, because most frauds against institutions need an employee to click, pay or share an OTP. Fraudsters who do it commit identity theft (s.66C, IT Act) and cheating by personation (s.66D), each punishable with up to 3 years and fine up to ₹1 lakh. But the institution usually bears the loss: a payment made to an impostor does not ordinarily discharge the real debt. A 30-minute quarterly drill, with records kept, also builds the due diligence file that protects officers under s.85.

Why staff training beats most technology

Spam filters do not stop an accounts clerk in Varanasi who reads a convincing email from a “vendor”, or a section officer in Patna who gets a WhatsApp showing the Director’s photograph. These frauds work on people, so the fix is a habit of pausing and verifying, repeated until routine.

A training session needs a room and half an hour. One misdirected vendor payment can cost lakhs, plus audit queries and sometimes paying the vendor twice.

The four tricks every employee must recognise

1. Look-alike domains

Read the sender address letter by letter. Common tricks:

• “rn” for “m”: “rnicrosoft.com” looks like “microsoft.com” at a glance.
• Capital “I” for small “l”: nearly identical in many fonts.
• Hyphens for dots: “accounts-collegename-in.com” is a different domain from “accounts.collegename.in”.
• A changed ending: “.co” for “.com”, or “.org” where the real one is “.gov.in”.
• Display name trick: the name shows “Registrar Office”; the address behind it is a free email account.

A padlock only means the connection is encrypted, not that the site is genuine.

2. Business email compromise (BEC)

An email from a regular supplier: “Our bank account has changed. Please release the pending payment to the new account.” Either the supplier’s mailbox was hacked, or a look-alike address was used. The cure is a call-back on the number already on the vendor file, never the number in the email.

3. Head-of-office impersonation

“I am in a meeting and cannot talk. Buy ten gift cards and send the codes.” A standing written instruction from the head of office, that no financial request received only on a messaging app will be acted upon, removes the junior officer’s hesitation.

4. OTP and credential fraud

A caller posing as the bank or IT section asks for an OTP, or a link asks staff to “re-validate” a password. No genuine bank or IT team needs your OTP. A fake login page that harvests the password is s.66D; using that password to enter the mailbox is s.66C, and also s.43 and s.66.

The legal angle: who is liable, and who loses

The fraudster. Identity theft under s.66C and cheating by personation under s.66D, each with up to 3 years and fine up to ₹1 lakh. Under the Bharatiya Nyaya Sanhita, cheating (s.318) and cheating by personation (s.319) apply in parallel. Where a gang runs such frauds as a continuing activity, organised crime under BNS s.111 can be added.

The institution. As a general principle of contract law, a debt is discharged by payment to the creditor or to someone the creditor authorised. Paying an impostor does not ordinarily discharge it. So the college that paid ₹6 lakh into a fraudster’s account may still owe its supplier ₹6 lakh. The RBI customer liability framework for unauthorised transactions generally does not help, because the institution authorised the payment. Fault may be shared if the supplier’s mailbox was breached through poor security, so vendor contracts should carry security and bank-change clauses.

The officers. A compromised official mailbox is a reportable incident to CERT-In within 6 hours. Failure is punishable under s.70B(7). Where the contravention is by a company (body corporate, firm or association of individuals), s.85 makes persons in charge answerable unless they prove due diligence. For a government department, whether s.85 applies depends on the facts. In every case, training records are part of that proof.

What a 30-minute quarterly drill looks like

1. Minutes 0 to 5: one real-style example from the last quarter (anonymised), shown on screen.
2. Minutes 5 to 15: five sample emails or messages. Staff mark each “genuine” or “suspicious” on a sheet. Include one look-alike domain, one bank-change request, one gift-card WhatsApp, one OTP call script and one genuine email.
3. Minutes 15 to 22: walk through the answers, pointing to the exact letter, domain or request that gave it away.
4. Minutes 22 to 27: restate the three office rules: call back on the number on file; no money on messaging-app requests; report to the nodal officer, and 1930 if money is lost.
5. Minutes 27 to 30: attendance sheet signed; scores collected.

Rotate the examples every quarter.

Measuring whether it works

• Drill scores by section, quarter on quarter.
• Reporting rate: suspicious emails forwarded to IT. Rising reports are good.
• Call-back compliance: sample vendor bank changes and check the call-back was recorded.
• Simulated phishing by the IT section, if it has the tools and approval: click rate should fall over time.

Keep these figures on file as evidence of diligence.

Frequently asked questions

Who should attend phishing training?

Everyone with an official email; accounts, HR, procurement, IT and senior officers’ personal staff first.

Is the bank liable if we paid a fraudster on a fake instruction?

Generally not under the customer liability framework, because the institution authorised the payment. Call 1930 at once to try to freeze the money in transit.

Is phishing reportable to CERT-In?

Yes. Phishing, spoofing and unauthorised access to systems are among the incidents to be reported within 6 hours.

Does a training certificate count as compliance?

It is useful evidence of diligence. It is a certificate of completion, not a legal immunity or a professional qualification.

Quick quiz

Train your accounts, HR and IT teams with Cyber Crime Law for Offices and Institutions, ₹599. For staff who want personal online safety basics, see the Cyber Fraud Safety certificate course (₹299).

Sources

• Information Technology Act, 2000: ss.43, 66, 66C, 66D, 70B(7), 85
• Bharatiya Nyaya Sanhita, 2023: ss.111, 318, 319
• CERT-In Directions under s.70B(6), dated 28 April 2022
• RBI framework on customer liability in unauthorised electronic banking transactions (2017 circular, now in the Master Directions)

This page is for education and general information, not legal advice for a specific case. Law as on 29 October 2026.