Digital payments rules need to fix accountability: On November 7, the day before Diwali, India’s Unified Payments Interface processed 975 million transactions. Business Standard reported that banks had asked their fintech partners to tighten checks on the merchants they onboard. Two days before the UPI surge, the Reserve Bank of India consolidated its cybersecurity directions for authorised non-bank payment system operators.
The convenience of digital payments rests on a division of labour that most customers never see. The company whose app they use may have little control over the system that processes the payment or the account that holds the money. When a fraudulent transfer goes through, that division of labour can make it harder to establish who should have spotted it and who can still intervene.
READ | ATM count falls as India turns to digital payments
Who does what in a digital payment
The RBI regulates banks and oversees payment systems. Banks hold deposits and provide the accounts through which money moves. Payment aggregators collect money on behalf of merchants and settle it with them. Payment gateways provide the technology to route payment instructions without handling the funds. In UPI, the National Payments Corporation of India operates the platform, banks participate as payment service providers, and third-party apps give customers an interface through which to initiate transactions.
The division of labour becomes harder to supervise when payments are automated. Businesses use software to initiate payouts, often in large batches. If the credentials used to authorise those instructions are compromised, fraudulent payouts can resemble routine transfers. By the time an unusual payment is noticed, the funds may already have moved through accounts used to receive and pass on the proceeds of fraud.
The broader figures show how much is at stake. An RBI discussion paper, drawing on the National Cyber Crime Reporting Portal, puts reported digital payment frauds at 28 lakh in 2025, involving ₹22,931 crore. In 2021, the portal recorded 2.6 lakh reports involving ₹551 crore. These figures cover digital payment fraud generally. The RBI says many cases involve people being tricked into authorising a transfer themselves.
READ | Financial inclusion: UPI123Pay makes digital payments without internet possible
RBI rules reach beyond payment operators
The RBI brought payment aggregators under direct regulation in March 2020. Non-bank aggregators must obtain authorisation, meet capital requirements and keep funds collected on behalf of merchants in escrow accounts with scheduled commercial banks. The rules establish who is responsible for safeguarding those funds. A separate difficulty arises when an aggregator relies on outside companies for the technology that runs its business.
The November 5 directions consolidate rules first issued in July 2024. They put oversight of cyber risk with the operator’s board and require controls over system access, security assessments and incident response. Authorised operators must also ensure that relevant unregulated partners, including payment gateways and technology vendors, follow the directions, subject to mutual agreement. The consolidated directions took effect on publication for large and medium non-bank operators. For small operators, they take effect on April 1, 2028.
For a board, the practical question is what it can establish about a vendor’s systems before something goes wrong. An operator that depends on a vendor to detect a breach must be able to find out promptly what happened and which transactions were affected. That is a matter for the contract and for the people who will have to act on it.
READ | UPI MDR Charges: The case for a sustainable payment system
Merchant checks are only the first line of defence
A technically secure platform can still process fraudulent payments if it takes on a suspect merchant or misses a change in payout activity. The RBI’s payment aggregator directions require merchant due diligence and transaction monitoring. They allow non-bank aggregators to use agents for limited parts of verification, while leaving ultimate responsibility for due diligence with the aggregator.
It would make little sense to impose the same obligations on a software vendor and a bank that holds deposits. What each participant owes the system should depend on what it controls. When banks assess a fintech partner, its financial health is only part of the picture. They also need to know how it verifies merchants, how it detects abnormal transfers and whom to call when a payout needs to be stopped.
The test comes when a suspicious instruction arrives in the middle of an ordinary batch of transfers. The operator needs to know who can suspend further payouts. The bank receiving the money needs enough information to act while it can still trace the funds. If those responsibilities have to be worked out after the alert, much of the money may already be gone.