The steps of a typical attack
Most online crime follows a sequence. The offender first chooses a target and gathers information about it, which can be as simple as reading a public profile or buying a list of contact details. The offender then makes contact: a message, a call or a fake page designed to look genuine. The aim is to obtain something that opens a door, such as a password, a one-time code, a payment, or the installation of a harmful program.
Once the offender has access, the next step is to turn it into money or advantage. Funds are moved quickly through several accounts so that they are hard to trace, data is copied and sold, or a system is locked and a payment demanded for its release. Each stage uses tools that are cheap and widely available, which is why people with limited technical skill can carry out fraud on a large scale.
Common techniques
The techniques fall into a few families. Social engineering deceives a person into acting: phishing by message, vishing by call and fake offers all belong here. Malicious software is introduced through attachments, links or fake applications, and can record keystrokes, copy data or lock files. Credential attacks use stolen or guessed passwords, often reused across services. Fake websites and payment requests collect money or credentials directly. In the official statistics, one-time password fraud and online banking fraud together were the largest categories of cyber fraud in 2022, which shows how often success depends on the victim completing the last step.
The page on online fraud in India describes the main types and the figures, and the page on computer crime describes the categories of offence.
How to break the chain
Each step of an attack offers a chance to stop it. At the contact stage, a message that creates urgency, asks for a code or threatens a block should be treated with suspicion and checked through a number or website that the person already knows. At the access stage, unique passwords and a second step of verification make a stolen password far less useful. At the damage stage, backups kept apart from the main system limit the harm of a lock-up, and quick contact with the bank limits the loss of money.
Organisations add layers: updates applied promptly, limited access rights, logging that is kept long enough to be useful, and a plan for what to do when an attack happens. These practices are also what the law asks for in effect, since a body that is negligent about reasonable security practices can be liable to compensation, and under the Digital Personal Data Protection Act a failure to take reasonable security safeguards carries a penalty up to Rs 250 crore.
Reporting and the law
Whatever the method, an incident can be reported on the National Cyber Crime Reporting Portal at cybercrime.gov.in or through the helpline 1930. The offences that apply, such as sections 66C and 66D for identity theft and cheating by personation, are set out in the guide to the IT Act 2000, and the steps for a complaint are in the guide on how to file a cyber crime complaint online.