RBI Plans New UPI Security Rules to Strengthen Digital Payment Safety

The Reserve Bank of India is considering significant changes to the UPI payment system as it looks to strengthen security against the growing threat of online financial fraud. While digital payments have made money transfers faster and easier than ever, the increasing number of cyber scams has prompted regulators and banks to explore safer transaction methods without affecting user convenience.

Instead of delaying every online payment, banks have proposed a smarter approach that focuses only on transactions identified as suspicious. Under the proposal, routine UPI transfers would continue to be processed instantly. However, if a payment appears unusual or carries a higher risk, users may be asked to confirm the transaction before the money is transferred.

Banks have suggested displaying a confirmation message within the mobile banking app whenever the system detects a potentially suspicious payment. The prompt would ask users whether they genuinely want to proceed with the transfer.

If the customer selects Yes, the payment would be completed immediately. Choosing No would cancel the transaction. If the user does not respond, the payment could be processed after approximately one hour. The objective is to give customers additional time to recognize possible fraud before sending money.

The proposed verification process would not apply to every UPI payment. Instead, it would be limited to transactions that appear unusual based on predefined risk indicators. These could include transferring a large amount late at night, sending money to a beneficiary for the first time, transferring funds to a recently opened bank account, or suspicious payments worth Rs 10000 or more. Some banks have also suggested raising the threshold to between Rs 20000 and Rs 25000 in the future.

The move comes as cybercrime linked to digital payments continues to rise across India. Fraudsters increasingly rely on fake phone calls, phishing messages, fraudulent investment schemes, and deepfake videos to trick people into transferring money voluntarily. Such incidents are classified as Authorized Push Payment fraud because the victim personally initiates the transaction after being deceived.

According to available data, reported online fraud cases and financial losses have increased sharply over the past few years, highlighting the need for stronger safeguards in digital payment systems. Regulators believe preventive measures could reduce financial losses while maintaining public confidence in online transactions.

The National Payments Corporation of India has also expressed concerns that excessive restrictions could slow digital payment adoption and affect small businesses that depend on QR code transactions for daily sales. The Reserve Bank of India is currently reviewing all suggestions submitted by banks before making a final decision on the proposed changes.

The expected framework aims to strike a balance between security and convenience, ensuring that genuine users continue to enjoy seamless UPI payments while adding extra protection against increasingly sophisticated online scams.