Payroll Phishing Targeting Indian Companies

How Payroll Phishing Targeting Indian Companies Works

Overview: This scam targets HR and payroll teams at Indian companies, especially during peak filing times. Attackers pose as company management or the Income Tax Department using realistic emails crafted with AI that closely match the firm's communication style. By tricking employees into sharing W-2 or Form 16 data, logins, or resetting salary account details, scammers can steal sensitive information or divert entire payrolls. How It Works: Attackers research company hierarchies and send spear-phishing emails to HR or payroll administrators. The email claims, for example, an urgent reconciliation or audit inquiry from the CFO, or a government source requesting bulk employee data for tax compliance. Recipients are told to click secure links or download attachments, which often mimic Microsoft or Indian portal logins. Some messages request 'temporary' changes to direct deposit/UPI details for testing, which end up rerouting real salaries to scammer accounts. India Angle: Such attacks spike during March-May, when Form 16 and bonus payments are processed in metros like Bengaluru, Mumbai, Hyderabad, and Pune. Large startups, BPOs, and even schools have reported targeted campaigns, with emails in English and sometimes in Hindi for pan-India coverage. Trusted-sounding requests referencing SEBI, IT-Dept, or digital signature requirements are widely used. Real Examples: 1. "Dear HR, kindly upload all staff Form 16 PDFs to the new compliance portal: [phishing link]. 2. "Hi, as per audit, update payroll UPI to: [UPI_REDACTED] for March cycle." 3. Fake CFO message: "Share login credentials to complete government reconciliation." Red Flags: - Requests for bulk employee tax details or credentials - Email sender address [ADDRESS_REDACTED].g., .gmail) - Unscheduled payroll changes or new bank/UPI accounts - Unexpected attachments or link to non-official domains Protective Measures: Set up strict protocols for verifying payroll or tax info change requests. Verify all such requests over a separate communication channel. Use multi-factor authentication for payroll systems. Train HR staff to spot suspicious language, email domains, or urgent requests outside official workflow. Report all suspicious emails internally and scan attachments for malware. If Victimised: Immediately inform your company’s IT team. Revoke access to compromised accounts and alert the bank or payment provider to freeze suspicious transfers. Report to cybercrime.gov.in and share evidence with BharatSecure. Related Scams: Business Email Compromise scams, fake SEBI or statutory regulator compliance requests, and supply chain invoice frauds.

Visual Intelligence:

BharatSecure's AI has identified this as a used in scams targeting Indian users.

Who Does Payroll Phishing Targeting Indian Companies Target?

General public across India

Red Flags — How to Identify Payroll Phishing Targeting Indian Companies

• Urgent requests for payroll/tax credentials
• Misspelled or unusual sender email addresses
• Request to upload bulk employee data
• Unscheduled direct deposit/UPI detail change
• Instructions to use unfamiliar portals

What To Do If You Encounter Payroll Phishing Targeting Indian Companies

1. Do not click any links or share personal information
2. Block and report the sender immediately
3. Report at cybercrime.gov.in or call 1930
4. Inform your bank if financial details were shared

How to Report Payroll Phishing Targeting Indian Companies in India

• Call 1930 — National Cyber Crime Helpline (24x7)
• File a complaint at cybercrime.gov.in
• Contact your bank immediately if money was lost
• Call RBI helpline: 14440 for banking fraud

Frequently Asked Questions

What is Payroll Phishing Targeting Indian Companies?

Overview: This scam targets HR and payroll teams at Indian companies, especially during peak filing times. Attackers pose as company management or the Income Tax Department using realistic emails crafted with AI that closely match the firm's communication style. By tricking employees into sharing W-2 or Form 16 data, logins, or resetting salary account details, scammers can steal sensitive information or divert entire payrolls. How It Works: Attackers research company hierarchies and send spear

How does Payroll Phishing Targeting Indian Companies work?

Overview: This scam targets HR and payroll teams at Indian companies, especially during peak filing times. Attackers pose as company management or the Income Tax Department using realistic emails crafted with AI that closely match the firm's communication style. By tricking employees into sharing W-2 or Form 16 data, logins, or resetting salary account details, scammers can steal sensitive informa

How to protect yourself from Payroll Phishing Targeting Indian Companies?

Do not click any links or share personal information Block and report the sender immediately Report at cybercrime.gov.in or call 1930 Inform your bank if financial details were shared

How to report Payroll Phishing Targeting Indian Companies in India?

Report to cybercrime.gov.in or call 1930 (National Cyber Crime Helpline). You can also contact your local police station's cyber cell.

Verify Any Suspicious Message

Check any suspicious message, link, or call for free at bharatsecure.app. BharatSecure uses AI to detect scams in real-time and protect Indian users.