1 in 5 UPI users faced fraud; 51% victims didn't report, reveals survey

One in five UPI users in India faced fraud in the past 3 years, with 51% not filing complaints. A LocalCircles survey highlights growing risks and urges simplified, one-click reporting mechanisms

One in five families with a Unified Payments Interface (UPI) user has experienced fraud at least once in the past three years, according to a new survey conducted by LocalCircles. The findings come as UPI transactions have soared, with 185.8 billion transactions recorded in FY2024–25 — a 41.7 per cent increase from the previous year, accounting for 83.4 per cent of the total digital payment volume in the country.

 

The survey, which gathered over 32,000 responses from UPI users across 365 districts, found that fraudsters are exploiting the rapid adoption of UPI through a variety of tactics. Of those who reported experiencing fraud:

- 50 per cent said someone hacked their UPI settings or PIN and conducted unauthorised transactions

- 40 per cent admitted to inadvertently clicking on a payment link to accept funds, only to have their account debited instead

- 20 per cent reported clicking on a QR code that led to similar losses

- 20 per cent revealed their OTP or UPI PIN to someone posing as a bank official, resulting in unauthorised debits

 

Many victims experienced more than one type of fraud, underscoring the sophisticated and evolving methods used by cybercriminals.

Underreporting of fraud incidents

A particularly concerning finding is that 51 per cent of those who experienced UPI fraud did not file any official complaint, whether with the police, their bank, the UPI platform, or regulatory bodies such as the National Payments Corporation of India (NPCI) or the Reserve Bank of India (RBI). This significant underreporting suggests that the true scale of UPI-related fraud is likely much higher than official statistics indicate.

Regulatory and technological response

The RBI’s Annual Report for FY2024–25 noted a sharp rise in digital payment frauds, with 13,516 cases accounting for 56.5 per cent of all reported banking frauds and losses totalling Rs 520 crore. While not all these cases are UPI-specific, the inclusion of UPI in these figures reflects its vulnerability as a target for fraudsters.

To combat these threats, several measures have been implemented:

 

- The RBI has set up the Central Payment Fraud Information Registry (CPFIR), which uses artificial intelligence and machine learning to track and report payment frauds.

- Security features such as device binding, PIN-based two-factor authentication, and daily transaction limits have been introduced. The daily UPI transaction limit is Rs 1 lakh, with higher limits for specific transaction types.

- The government has launched the National Cybercrime Reporting Portal and helpline 1930 for reporting suspicious activities.

- The RBI is developing a Digital Payments Intelligence Platform, leveraging advanced technologies for real-time fraud detection and mitigation. A committee led by former NPCI MD and CEO AP Hota is overseeing this initiative.

- In December 2024, the RBI introduced MuleHunter.AI, an AI-ML-based tool to identify mule accounts used for illegal activities, piloted successfully in two public sector banks.

- Exclusive internet domains (.bank.in and .fin.in) are being rolled out to combat phishing and enhance trust in digital banking.

Public awareness, need for simplified reporting

Despite these measures, user feedback from the survey indicates a pressing need for easier, single-click fraud complaint reporting that is both responsive and effective. Many users expressed frustration with the complexity and inefficiency of current reporting mechanisms. The study recommends that all stakeholders—including the government, RBI, NPCI, banks, and payment platforms — work towards a streamlined, user-friendly system for fraud reporting, with timely response and resolution.