INDUSTRY FACT FILE · ITES, BPO, KPO & GCCS

Threat Landscape: Top Cyber Threats Facing ITeS, BPO, KPO and GCCs

The 18 most relevant cyber threats, attacks and industry challenges for contact centres, back-office operations, shared service centres and GCCs.

Attackers target service centres through their people and processes. Criminal groups recruit agents to leak data, impersonate staff to obtain password and MFA resets, and send fake bank-change letters to finance teams.

Widely reported incidents—help-desk social engineering behind a major US casino breach in 2023 and bribed overseas support contractors leaking a US crypto exchange's customer data in 2025—show how human-centred attacks bypass technical controls.

The list below is a practical assessment framework, not a statistical ranking. Priority varies by business model, technology exposure and existing controls.

The matrix is a qualitative guide for prioritising the first round of security reviews.

Figure 5: Qualitative threat relevance by service-centre segment (Codec Networks assessment).

4.1 Insider data theft and bribery

Criminal groups recruit agents through social media and messaging apps, paying for screenshots or exports of customer records that are then used for impersonation scams.

• Questions to test: Is customer data masked on screens? Are phones barred from sensitive floors? Are unusual look-up patterns monitored?
• Relevant services: masking and access reviews, clean-desk controls, UEBA, insider investigations.

4.2 Help-desk social engineering

Attackers call internal help desks posing as employees or managers and talk agents into resetting passwords and MFA. The resulting access is used for data theft and ransomware.

• Questions to test: How are callers verified? Are resets for privileged users approved out of band? Are resets followed by unusual access flagged?
• Relevant services: help-desk control testing, social-engineering simulations, identity monitoring.

4.3 Payment and vendor-master fraud

Shared service centres process large payment runs. Fake bank-change letters from compromised vendor mailboxes are a leading cause of losses.

• Questions to test: Are bank changes verified by call-back on known numbers? Is there maker-checker approval? Are payment anomalies monitored?
• Relevant services: payment-control testing, BEC simulation, SOC use cases.

4.4 Work-from-home leakage

Remote agents may save files locally, use personal devices or print at home. Lost or stolen laptops expose customer data.

• Questions to test: Is delivery through VDI or locked-down devices? Is disk encryption enforced? Does DLP block local saves and USB?
• Relevant services: WFH assessments, VDI review, DLP assessment.

4.5 GCC privileged access and the 6-hour clock

GCC engineers often hold administrative rights in global systems. A compromised GCC account can lead to a global incident, and CERT-In requires reporting within six hours.

• Questions to test: Is a tiered admin model in place? Is phishing-resistant MFA enforced for privileged users? Is there a joint India–global playbook?
• Relevant services: PAM review, red teaming, joint SOC, cross-border IR playbook.

• CERT-In: incidents reported within six hours of noticing them.
• Clients: contracts require prompt notification and cooperation, and may trigger audits, penalties or termination.
• Client regulators: regulated clients may need to report provider-caused incidents to RBI, SEBI or IRDAI.
• Privacy: clients as data fiduciaries must intimate personal data breaches to the Data Protection Board once DPDP breach provisions commence in May 2027; overseas clients may have GDPR or HIPAA notification duties.
• Card brands: card-data compromises can trigger PCI forensic investigations.

• What customer data can a typical agent see, and could they photograph or copy it?
• How does our help desk verify a caller before resetting MFA?
• Are bank and vendor-master changes verified out of band?
• Are work-from-home devices encrypted and covered by DLP?
• Do GCC accounts hold administrative rights in global systems?
• Could we report an incident to CERT-In within six hours and notify every affected client?

Note: Threat descriptions and relevance ratings are general guidance, not findings about any specific organisation. Public incident references are summarised from widely reported events.