Phishing drills built around the payment approvals finance teams actually make
TL;DR Baitwise runs phishing drills for the 10–40 people in a mid-size company who can move money - accounts payable, treasury, payroll and their approvers. The drills copy the scams these people actually face, like a vendor's "new bank account" or an urgent chat message from the CFO. Companies pay a yearly per-seat fee.
Most phishing programmes send everyone the same fake parcel-delivery email once a quarter. The research says that's weak. A 2024 review found targeted simulations reduce susceptibility more than generic training, while generic methods do little for staff who are already prone to click, and about 32% of people fall for phishing at least once when exposed[1].
In a company, the expensive mistakes come from a small group - the people who change vendor bank details or release payments. The RBI has flagged digital-payment fraud as a significant concern and is moving banks to a 'bank.in' domain to cut phishing[2], but that does nothing for a forged invoice landing on a company's accounts desk. I couldn't find any public figure for India-specific losses to invoice and CEO-impersonation fraud.
Baitwise is a drill programme for payment staff only. It doesn't try to train the whole company.
It starts with a one-hour setup where the finance head lists real vendors, approval limits and the channels staff use (email, chat apps, phone). Baitwise then sends drills that look like the company's real workflow. Think a known supplier asking to update bank details, a "CFO" on a new number wanting an urgent transfer before a board meeting, or a GST notice with a link to a fake portal. Drills come by email and, with consent, by chat app and voice calls.
When someone falls for one, a two-minute lesson on the exact cue they missed follows right away. Each month the finance head gets a short report on who verified a request through a second channel and who didn't, measured against the company's own payment policy.
The seed pitched AI-personalised simulations for everyone. I narrowed it to the people who control money, because a review of the research found targeted drills work better than generic ones[1], and because a finance head will happily pay for a small, high-risk group before paying for company-wide training.
The accounts and treasury team uses it. The CFO or financial controller pays, sometimes jointly with the CISO. The reference price is the global per-seat rate - the global market leader lists about ₹2,300–3,700 per seat per year for 101–250 seats (US$23.64–38.28)[3]. Baitwise charges more per seat for a much smaller group, so the total contract stays small.
The DPDP penalties apply from 13 May 2027, with a ceiling of ₹250 Cr for failing reasonable security safeguards[4], and boards are asking what staff training exists. The CERT-In directions already require incidents to be reported within six hours[5]. Cheap voice cloning makes the fake CFO call easy to stage, which strengthens the case for drills that go beyond email.
I found no figure for India's phishing-simulation market or for business-payment fraud losses. The nearest signal is that buyers already pay. One Indian vendor says it has run phishing simulations on more than 5.7 million employees[6], and the global leader publishes per-seat prices for India's market band[3]. Treat both as proof the category sells, not as its size.
An Indian awareness platform runs phishing, vishing and deepfake simulations with risk scores and multilingual learning paths[6]. The US market leader is the global default, with a large template library[3]. Both sell company-wide awareness.
The gap is a programme designed around the payment approval chain, using the company's own vendors and limits and priced for a finance budget.
| Difficulty | Moderate (37/100) |
| Starting capital | ₹45–85 L |
| Time to launch | 4–6 months |
Sending emails is a breeze. Realism without harm, and permission, are the hard parts. Drills that copy real vendors and the CFO's voice need written approval from the company, clear rules on who gets told in advance and care with staff's personal phone numbers. Email filters will also block your drills unless each client whitelists them properly.
No sector licence to run drills, but how you send them and handle staff data matters.
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
Don't let AI decide anything about a person's job based on drill results. Those scores are for training, not discipline.
Want to work out the AI layer for Baitwise? Talk to Yash →
This is a reasonable bet if you've worked in corporate finance or fraud investigation and can sell to CFOs. If you're a generic security-awareness team then skip it, because the incumbents already do that well. Prove first that drills based on real vendors raise the share of staff who verify bank changes through a second channel within three months.
Plan for roughly ₹45–85 L, mostly on building realistic drills and selling to CFOs.
No sector licence. You need DPDP processor terms with clients, care over chat and voice drills, and the usual company registration and GST.
Yes. Payment fraud through fake vendor emails happens everywhere, so the model travels if you follow local data and calling rules.
The free Baitwise validation kit has the line-by-line capital breakdown, the effort scoring, the consent and data-protection checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for CFOs and finance staff, and 5 assumptions to test. Download the kit →
Thinking about building Baitwise or something close to it? The make-or-break work is staging realistic payment-fraud drills that finance teams accept as fair, and I'd be glad to help you think through the rules of the game. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.