BFSI Insight Summit 2026: 'Real-time fraud check key in digital payments'

At the BFSI Insight Summit 2026, payments leaders called for AI-driven fraud detection, real-time risk scoring and greater industry collaboration to tackle rising digital payment scams

At a discussion on India’s digital payments ecosystem, ‘Payments at Scale, Can Security Match It?’ during the Business Standard BFSI Insight Summit, industry leaders Karan Sapra, head of payments and financial services, India, at Google Pay; Lalit Chowdhary, senior vice-president, implementation and delivery at Mindgate Solutions; Arif Khan, chief investment officer (CIO) of Razorpay; and K Satyanarayana Raju, chief executive officer (CEO), India Digital Payment Intelligence Corporation (IDPIC), elaborated on the need to go beyond conventional checks and adopt an intelligence-driven approach to tackle increasingly sophisticated fraud.

 

A central theme of the discussion was the changing nature of digital payments fraud. According to Khan, conventional safeguards such as one-time passwords, PINs and authentication protocols are no longer sufficient to address the full range of risks.

 

 

“The bigger challenge that we are seeing is context in the intent of the payment,” Khan said, explaining that a transaction may be technically secure even when a customer is being manipulated into transferring money.

 

Fraudsters increasingly exploit fear, urgency and impersonation, posing as law enforcement officials or other trusted authorities, to persuade victims to make payments voluntarily. The challenge, therefore, is no longer just to ensure that a payment is authorised, but to establish whether the person making it understands the transaction and its consequences.

 

Khan said Razorpay was working to analyse multiple signals to understand the context and intent behind payments. He also pointed to the growing sophistication of fraud networks, which can move money rapidly through mule accounts, while payment companies often operate with limited visibility into one another’s systems.

 

Sapra highlighted a similar shift, describing the evolution from hacking technical processes to manipulating human behaviour.

 

He said Google Pay was focusing on user education, contextual warnings and the use of artificial intelligence (AI) to identify suspicious patterns. Such warnings could be delivered in English, Hindi/English or regional languages, depending on what users understand best.

 

The company has also introduced haptic alerts—gentle phone vibrations intended to interrupt routine payment behaviour and prompt users to reconsider a potentially risky transaction.

 

The objective, Sapra said, is to combine intelligence drawn from multiple signals with timely interventions that help customers recognise a threat before the money is transferred.

 

The need for greater cooperation across the payments ecosystem emerged as another key issue.

 

Chowdhary said Mindgate Solutions, which processes a significant share of payment transactions, had observed that although larger banks had strengthened their fraud-detection frameworks, vulnerabilities often persisted at the edges of the system. Money can pass through mule accounts quickly, making detection and recovery difficult.

 

He emphasised that the industry needed to improve its ability to identify suspicious activity and recover funds promptly.

 

Raju outlined the role of the Digital Payment Intelligence Platform (DPIP), developed by the Reserve Bank of India (RBI) Innovation Hub with the support of the RBI, in strengthening the ecosystem’s response to fraud.

 

The initiative is being implemented in phases. The first phase focuses on creating a smart registry of suspicious identifiers and enabling participating institutions to screen their records against the registry.

 

The platform aims to onboard 120 regulated banking entities and 69 payment aggregators. At the time of the discussion, 16 banks had gone live, contributing nearly 3.2 million reports and around 6.4 million identifiers, Raju said.

 

He added that nearly 70 million records had been screened, identifying around 230,000 suspected identifiers and 70,000 alert identifiers. Around 92,000 identifiers had been reported by multiple channels, including more than one bank.

 

The registry is intended to help institutions identify potentially suspicious accounts during customer onboarding and beneficiary addition, as well as through periodic screening of existing records.

 

This could help detect mule accounts before a formal complaint is filed, shifting the emphasis from responding to fraud to preventing it.

 

Raju said the platform could eventually be extended to other sectors, including cooperative banks, non-banking financial companies (NBFCs), insurance companies and e-commerce businesses, although stabilising the initial phases remains the immediate priority.

 

Participants said the next step would be to move beyond periodic screening towards real-time risk assessment.

 

Raju added that the platform’s planned second phase would use transaction histories and behavioural patterns to generate risk scores for individual digital payments. These scores would be shared with both the sending and receiving banks, helping them decide whether a transaction should proceed or whether a credit to the beneficiary’s account should be held pending further checks.

 

The proposed approach would use data relating to both the payment initiator and the beneficiary, along with the reporting institution’s history, to assess risk. Models developed using data from larger banks could also help smaller institutions strengthen their fraud-detection capabilities.

 

Khan argued that the value of such a system would depend on how effectively participants combine their intelligence. A payment service provider may detect a compromised device, while another institution might identify the receiving account as a potential mule. Taken together, these signals could provide a much stronger indication of fraud than either signal alone.

 

The challenge, he said, is to analyse device information, transaction patterns, merchant behaviour and the destination account’s history in less than a second, before a suspicious payment is completed.

 

He also stressed the importance of predictive modelling, arguing that fraud prevention cannot rely entirely on historical data. Fraudsters continually change their methods, requiring the ecosystem to anticipate emerging threats rather than merely react to known ones.

 

Sapra said Google Pay was using an AI-powered conversational agent to interview users after fraud incidents, helping identify new methods used by scammers and develop patterns that could inform future defences.

 

The discussion also examined whether India’s enormous payment volumes were making the system more vulnerable.

 

Chowdhary said the rapid growth of Unified Payments Interface (UPI) had pushed payment infrastructure providers to adopt newer technologies, reduce pressure on core systems and improve reliability. He added that person-to-merchant payments had been a major driver of growth, requiring infrastructure to evolve alongside transaction volumes.

 

He said technology upgrades and collaboration with ecosystem partners had helped providers manage scale, but stressed that the overall system was only as strong as its weakest link.

 

Khan offered a more measured view, arguing that scale itself should not be seen as the principal obstacle. Improvements in computing power, chips, networks and bandwidth had made it possible to handle large transaction volumes.

 

The more persistent concern, he said, was the uneven security maturity of institutions. Established organisations may continue to rely on legacy systems and older databases, while newer technology companies often operate on more modern Cloud-based infrastructure. Both types of institutions need strong safeguards, but their vulnerabilities may differ.

 

Chowdhary also highlighted the importance of addressing emerging software vulnerabilities, strengthening application programming interface (API) security and improving mobile verification during customer registration.

 

A key intervention during the session was the argument that the industry’s existing measures of fraud do not fully capture its social and financial impact.

 

Khan said commonly used indicators, such as chargeback ratios and fraud as a proportion of sales, offered only a partial picture. A low fraud ratio across billions of transactions might appear reassuring, but it could obscure the severe consequences for an individual who loses a substantial portion of his income.

 

He urged the industry to develop measures that reflect how long a mule account remains active, how quickly it is identified and shut down, and how much times it takes for victims to obtain relief.

 

Sapra added that fraud is frequently under reported. Victims may not immediately realise they have been deceived, particularly in investment scams, while others may hesitate to report an incident because of social stigma.

 

The speakers said better measurement would help the industry understand not just the number of reported cases, but also the extent of the harm caused and the effectiveness of its response.

 

The panel concluded that technology alone would not eliminate payment fraud. Social engineering increasingly relies on psychological pressure, pushing victims to act quickly before they have time to verify a request.

 

Khan suggested that certain high-risk situations could warrant a deliberate waiting period, giving customers time to reconsider urgent or emotionally charged requests. He also called for greater scrutiny of incoming payments, particularly where suspicious funds may be moving through beneficiary accounts.

 

Sapra emphasised the need to combine AI-driven detection with user education and timely warnings. Raju said the planned risk-scoring system could strengthen checks on both the sending and receiving sides of a transaction.