India’s Unified Payments Interface processed 24.51 billion transactions worth ₹29.82 lakh crore in August 2026, an average of roughly 791 million a day. Few payment systems anywhere move money this fast, at this scale, for this many first-time digital users. That success has a shadow.
According to the Indian Cyber Crime Coordination Centre (I4C), citizens filed 21.77 lakh cheating-related complaints in 2025 and reported losses of ₹19,813 crore. An I4C projection reportedly puts the true 2025 figure closer to ₹1.2 lakh crore, about 0.7% of GDP, because most victims never report. Recovery remains the exception: by one estimate, three of every four rupees lost are never returned.
For banks, fintechs and NBFCs, the question is no longer whether to invest in fraud prevention. It is where in the transaction journey that investment actually works.
The numbers hide where fraud lives
The RBI’s Annual Report for 2024-25 shows bank fraud cases falling 34% to 23,953, while the value involved rose to ₹36,014 crore. Read quickly, that looks like progress on volume. But digital payment frauds made up 13,516 of those cases and only ₹520 crore of the value, and the RBI dataset counts only frauds of ₹1 lakh and above. The small-ticket, highfrequency fraud that hits ordinary customers largely sits below that line.
Look at what those customers are reporting. I4C’s complaint mix for 2025 shows 36% investment fraud, 27% credit card fraud, 19% sextortion, 10% e-commerce fraud and 6% “digital arrest”. Investment schemes alone accounted for more than three-quarters of rupees lost. Around 45% of complaints traced back to operations in Cambodia, Myanmar and Laos.
The common thread: in most of these cases, the customer initiates the payment. The OTP is correct. The device is registered. The PIN matches. Every traditional control passes, because those controls verify the device and the credentials, not the circumstances in which the person is using them.
Moving detection to the moment of action
This is why device-level intelligence matters for the industry. The signals that separate a coerced payment from a genuine one exist on the phone, in the seconds before money moves: a screen-sharing or remote-access app running in the background, an accessibility service reading the display, an overlay drawn over the banking app, an active voice call during a high-value transfer, or typing and navigation patterns that don’t match how this customer normally behaves.
None of these signals is visible to a server-side rules engine looking at amount, time and beneficiary. Captured on the device and scored in real time, they let an institution add friction exactly where risk is high (a cooling-off delay, a call-back, a step-up check) while leaving the vast majority of transactions untouched.
That last point matters commercially. Blunt rules generate false positives, and every false decline is a customer who tries a competitor’s app next time. In bank deployments I have worked on, adding behavioural and device signals to existing models reduced false positives from 35% to 6% and cut investigation time from roughly 40 minutes per case to seconds. Precision, not just detection, is what makes prevention sustainable.
Following the money across institutions
Fraud doesn’t stop at one bank. Proceeds move through mule accounts, often several layers deep, within minutes. I4C has shared details of more than 3.05 million suspicious accounts with stakeholders and helped block transactions worth ₹25,698 crore. RBI’s MuleHunter.AI is now live in 26 banks.
These are significant steps, and they also show the scale of the problem. Graph-based analysis that links devices, accounts and behaviour across institutions can surface coordinated rings rather than individual accounts, turning thousands of isolated alerts into a handful of networks to act on.
Who benefits most
The largest banks have data science teams and budgets to build this in-house. The next hundred banks, co-operative banks, payment aggregators and young fintechs often don’t, yet fraudsters deliberately target the weakest link in the payment chain. Lightweight, privacy-preserving device intelligence that processes data locally, in line with the Digital Personal Data Protection Act, lowers that barrier for the whole ecosystem.
I4C’s reporting system has already saved over ₹11,158 crore by moving fast after fraud is reported. The next gain will come from acting before the customer presses “pay”. At 791 million transactions a day, the institutions that see risk on the device first will be the ones whose customers keep trusting digital payments.
_________________________________________________________
Sources: NPCI (UPI data, Aug 2026); I4C / National Cyber Crime Reporting Portal (2025 complaints and losses); RBI Annual Report 2024-25; MHA replies in Parliament (suspicious accounts, amounts blocked/saved; MuleHunter.AI deployment, Mar 2026).
Join our LinkedIn group Information Security Community!
