From January to June 2024, organisations and businesses in India saw 135,173 phishing attacks related to finance matters – e-commerce, banking, and payment systems.
Financial phishing attacks are rapidly increasing in the country as cybercriminals continuously evolve and adapt their tactics, making them sophisticated. The number of attacks rose 175 percent compared to the same period of time last year, underpinned by increased digital adoption and use of artificial intelligence and automation by threat actors to render convincing contents and target victims more effectively.
“The COVID 19 pandemic accelerated the adoption of online banking and use of digital financial services and has provided a much larger pool of potential victims. The alarming jump in the number of attacks is also attributable to the rise of fraudulent activity rather than a decline in user vigilance: cybercriminals are becoming more aggressive in their pursuit of users’ data and money,” says Jaydeep Singh, General Manager for India Region at Kaspersky.
Financial phishing is a type of phishing which refers to fraudulent resources related to banking, payment systems and digital shops.
Through phishing, attackers manipulate victims to divulge their personal and valuable information such as login credentials to social media accounts and financial accounts, as well as other personal or corporate information that can lead to potential identity and data thefts. They are also launching more advanced social engineering schemes masquerading as financial institutions to invoke fear and exhort victims, and in some instances impersonating charitable organisations to trick victims into making contributions.
“Financial phishing will continue to evolve in this country and sectors like banking, insurance, and e-commerce will be prime targets. It is imperative for companies to step up in their security measures, by implementing advanced security solutions, adopting best practices and training their workforce to raise awareness of cyber threats and how to protect their organisations,” adds Jaydeep.
To help companies protect their systems against the wide range of cyberthreats, including but not limited to phishing attacks, Kaspersky experts recommend:
- Always keep software updated on all the devices to prevent attackers from exploiting vulnerabilities and infiltrating organisation’s network.
- Promptly install available patches for commercial VPN solutions providing access for remote employees and acting as gateways in your network.
- Back up data regularly and ensuring they can be accessed quickly when needed or in an emergency.
- Avoid downloading and installing pirated software or software from unknown/unverified sources.
- Assess and audit your supply chain and managed services access to your environment. Kaspersky offers compromise assessment services.
- Do not expose remote desktop/management services (such as RDP, MSSQL, etc.) to public networks unless absolutely necessary and always use strong passwords, two-factor authentication and firewall rules for them.
- Monitor access and activity by having visibility over the network to spot any unusual activity, and controlling user access to as-need, and as-required basis to minimise risks of unauthorised access and data leak.
- Set up a security operation centre (SOC) using an SIEM (security information and event management) tool like Kaspersky Unified Monitoring and Analysis Platform, a unified console for monitoring and analysing information security incidents, and solutions such as Kaspersky Next XDR Expert, a robust cybersecurity solution that defends against sophisticated cyberthreats.
- Use the latest Threat Intelligence information to have an in-depth visibility into cyberthreats targeting your organisation and provide your InfoSec professionals with the most comprehensive and up-to-date information regarding potential malicious actors and their TTPs.
- Employ Kaspersky Professional Services to optimise the workload of your heavily challenged IT department. Kaspersky experts assess the state of your current IT security, then deploy and configure Kaspersky software quickly and properly to ensure hassle-free ongoing performance.
- If your company does not have a dedicated IT security function and only has generalist IT admins who may lack the specialist skills required for expert-level detection and response solutions, consider subscribing to a managed service such as Kaspersky MDR. This would instantly boost your security capabilities by an order of magnitude, while allowing you to focus on building in-house expertise.
- For protection of very small businesses, use solutions intended to help you manage your cybersecurity even without having an IT administrator on board. Kaspersky Small Office Security provides you with hands-off security due to ‘install and forget’ protection and saves the budget which is crucial, particularly in the early stages of business development.
- Educate employees and improve their cybersecurity literacy through tools such as Kaspersky Automated Security Awareness Platform – Employees should be aware of the risks of cybersecurity threats and how to protect themselves and organisation from them.
- Train and upskill your cybersecurity team/professionals with Kaspersky Expert training to advance their skills and defend organisation against attacks.
