Proofpoint’s latest analysis reveals that nearly two in five Indian local banks remain vulnerable to email‑based impersonation attacks because they have not implemented the strictest form of domain protection. While overall adoption of the DMARC email authentication standard is high, inconsistent policy levels mean customers and employees at many banks are still exposed to phishing, business email compromise and brand spoofing campaigns.
DMARC Adoption Is High, but Protection Levels Vary
The study examined 80 local banks in India and found that 99 percent have some form of DMARC in place, indicating strong awareness of email authentication as a control. However, only 61 percent enforce the most secure “reject” policy that blocks spoofed messages outright, while 28 percent use “quarantine” and 10 percent remain at a “monitor” setting.
As a result, 39 percent of banks still do not enforce the recommended highest level of protection, leaving a window open for attackers to send fraudulent emails that appear to originate from trusted banking domains.
Rising Email Fraud Highlights Sector Exposure
Proofpoint situates these findings against a backdrop of rising cyber‑enabled financial fraud in India, including phishing, business email compromise and brand impersonation schemes.
Official data cited from the National Cyber Crime Reporting Portal shows reported cyber‑fraud losses of around ₹36.45 lakh as of February 2025, underscoring the real financial and reputational stakes involved. The company argues that as India’s digital banking adoption accelerates, email remains a primary channel through which criminals can mislead customers, initiate fraudulent transactions or harvest credentials.
Stronger Controls and User Vigilance Both Required
Proofpoint recommends that banks and other organisations not only move to a DMARC “reject” policy where feasible, but also pair technical controls with phishing‑resistant multi‑factor authentication and robust user awareness.
Customers and staff are advised to treat unsolicited emails carefully, verify the legitimacy of login requests or urgent account notices, and remain alert to subtle impersonation cues even when messages appear to come from familiar brands. The research frames email authentication as a necessary but not sufficient defence layer, calling for a combination of policy, technology and behaviour change to maintain trust in India’s banking system as cyber threats evolve.
