Digital Payment Frauds In India - A Critical Analysis Of RBI’s Regulatory Framework & Effectiveness
Author: LawSphereX
Category: Technology, Cyber & Privacy
Published:
Updated:
DIGITAL PAYMENT FRAUDS IN INDIA: A CRITICAL
ANALYSIS
OF RBI’S REGULATORY FRAMEWORK & EFFECTIVENESS
Askina Gohain, LL.M, Amity University, Noida
ABSTRACT
“We live in the digital age, where cash is disappearing, and clicks are replacing coins—but with this convenience comes the rising threat of digital payment frauds, turning every transaction into a potential risk. ” The growth of digital payments in India has not just improved accessibility and convenience. Also, incidents of fraud are becoming a regular occurrence which raises questions of consumer protection and financial security. In this paper, we analyse and criticize the regulatory framework of the RBI (Reserve Bank of India) with respect to frauds and the digital payment. The review highlights important regulations such as the Act of 2007 on Payment and Settlement Systems, RBI Security Instructions and recent policies.
The research shows the advantages and disadvantages of the existing method through case studies and contemporary trends with a complete recommendation of stricter regulation, better technology, and raised consumer alertness. The paper recommends improving the RBI policy by only emphasizing a robust digital payments ecosystem in India. Keywords: Digital Payments, RBI Regulations, Cybersecurity, Fraud Prevention.
INTRODUCTION
India is witnesses massive digital payment services in recent years. People can perform financial services conveniently and efficiently from their mobile phones. Nonetheless, this digital shift has also made users or financial institutions vulnerable to increasing cyber attacks like digital payment frauds. Fraudsters use many tactics to take advantage of technical loopholes and user weaknesses. These include phishing, identity theft, malware and unauthorized transactions. Victims suffer losses and an erosion of trust in digital transactions. In light of these threats RBI has issued a slew of regulations to curb fraud and ensure security of digital transactions. The Payment and Settlement Systems Act 2007 regulates digital payment systems in India and makes them efficient and secure.
The RBI has also issued cybersecurity rules for all payment service providers (PSPs), which include an additional factor of authentication (AFA), alerts, fraud detection, and consumer feedback. Even though we have good regulations in place, hackers are using new techniques exacting the old ones. This research examines RBI’s regulations to prevent fraud in digital payments. It examines important rules, how failure to enact them has resulted in fraud, and their effectiveness in preventing fraud. The research also points out the shortcomings in the regulatory framework which include advanced tools for cyber security, real-time fraud detection systems, and greater consumer awareness programs.
Lastly, it discusses possible solutions and suggestions for making digital payment a safer and reliable financial system in India REVIEW OF LITERATURE The increasing adoption of digital payment systems in India has led to a surge in financial frauds, including phishing, identity theft, and unauthorized transactions (Gupta & Sharma, 2021). While platforms like UPI, mobile wallets, and internet banking have enhanced financial inclusion, they have also introduced new vulnerabilities (Bhattacharya et al. , 2020). A significant challenge is the lack of digital literacy and weak authentication mechanisms, particularly in rural and semi-urban areas, contributing to rising fraud cases (Jain & Aggarwal, 2019). Additionally, regulatory gaps and delays in fraud detection continue to hinder effective prevention (Patil & Singh, 2022).
RBI's Regulatory Framework for Digital Payment Security To mitigate digital payment frauds, the Reserve Bank of India (RBI) has introduced measures such as two-factor authentication (2FA), tokenization, the Ombudsman Scheme for Digital Transactions, and cyber resilience guidelines (RBI, 2021). Scholarly analyses indicate that initiatives like the Positive Pay System and card transaction limits have helped reduce fraud risks (Kumar & Mehta, 2022). However, financial institutions face challenges in real-time fraud monitoring. Moreover, the effectiveness of RBI’s guidelines is limited by gaps in enforcement and regulatory oversight (Mishra, 2023). Effectiveness and Gaps in RBI’s Regulatory Measures Despite RBI’s regulatory efforts, digital frauds persist as cybercriminals continue to evolve their tactics, outpacing regulatory responses (Sinha & Verma, 2021).
The framework remains largely reactive, creating challenges in consumer protection and dispute resolution (Rajput, 2022). Regulatory compliance also varies across institutions. While major banks adopt advanced fraud detection technologies, smaller financial institutions and fintech companies struggle due to resource constraints (Nair & Menon, 2023). Additionally, consumer awareness campaigns mandated by RBI have had limited success in rural areas, further exposing users to financial risks (Das & Roy, 2021).
RESEARCH
METHODOLOGY
This study employs a doctrinal and analytical research approach, relying on secondary data sources to evaluate the effectiveness of the Reserve Bank of India's (RBI) regulatory framework in addressing digital payment frauds in India. The research draws upon legal statutes and regulatory guidelines, including RBI circulars and notifications, alongside judicial precedents and case laws to analyse disputes related to digital fraud. Additionally, it incorporates reports and research papers from financial institutions, government bodies, and academic journals, as well as media articles and industry reports to track emerging fraud trends and assess regulatory responses.
OBJECTIVE
OF THE STUDY-
To analyse the nature and trends of digital payment frauds in India – This study aims to examine the evolving patterns of fraud, including phishing, SIM swap frauds, malware attacks, and emerging threats like social engineering and deepfake technology. • To evaluate the effectiveness of the RBI’s regulatory framework – The research assesses key regulatory measures such as two-factor authentication (2FA), the Ombudsman Scheme, and the Payment and Settlement Systems Act, 2007, in mitigating digital payment frauds. • To identify regulatory gaps and challenges – This study explores the limitations and enforcement challenges within the existing RBI framework, including issues of reactive policymaking, inconsistent enforcement, and the adaptability of regulations to new fraud techniques.
• To propose recommendations for strengthening fraud prevention mechanisms – The research suggests legal, technological, and policy-based improvements, such as the adoption of AI-driven fraud detection, enhanced consumer awareness programs, and international cooperation, to make India’s digital payment ecosystem more secure and resilient.
CONCEPTUAL FRAMEWORK- CONCEPT OF DIGITAL PAYMENT: Digital payment refers to the process of making financial transactions electronically without the use of physical cash. It enables individuals, businesses, and governments to transfer money through digital platforms such as mobile applications, online banking, and electronic payment systems.1 In digital payments, both the payer and the recipient use digital modes to send and receive money, ensuring faster, more convenient, and secure transactions. With advancements in technology, digital payments have become an essential part of modern financial systems. From buying groceries to booking movie tickets, from ordering food to
1 Reserve Bank of India, Report on Trend and Progress of Banking in India 2022-23, December 2023.
splitting bills with friends—everything happens with just a tap on our smartphones. Digital payments have made life faster, easier, and more convenient. TYPES OF DIGITAL PAYMENT-
1 Mobile-Based Payment Systems
These are payment methods that rely on mobile devices for transactions. a. Unified Payments Interface (UPI): A real-time payment system developed by NPCI (National Payments Corporation of India).
Allows users to link multiple bank accounts to a single mobile app and transfer money instantly.2 Examples: Google Pay, PhonePe, Paytm, BHIM. b. Mobile Wallets: Prepaid instruments that store money digitally and can be used for payments, recharges, and transfers.3 Examples: Paytm Wallet, Mobi Kwik, Free Charge, Amazon Pay. c. Aadhaar-Enabled Payment System (AEPS) Allows bank-to-bank transactions using Aadhaar authentication and biometric data. Enables basic banking services like balance inquiry, cash withdrawal, and fund transfers.4
2 Card-Based Payments
Payments made using debit, credit, or prepaid cards. a. Debit Cards Linked directly to a bank account. Allows users to spend within their account balance. Widely accepted at ATMs, PoS terminals, and online platforms.
2 National Payments Corporation of India (NPCI), "Unified Payments Interface (UPI).
3 Reserve Bank of India (RBI), "Guidelines on Prepaid Payment Instruments.
4 Reserve Bank of India, Master Direction on Aadhaar-enabled Payment Systems, (2023)
b. Credit Cards Allow users to borrow funds up to a certain limit for payments. The borrowed amount must be repaid later, often with interest. Used for online and offline purchases. c. Prepaid Cards Cards loaded with a fixed amount of money in advance. And can be used until the balance is exhausted. Examples: Gift cards, travel cards. d. Contactless Cards (NFC) Use Near Field Communication (NFC) technology for quick, tap-and-go payments. And Enhances convenience and speed at PoS terminals.
3. Internet Banking
Online banking services provided by banks to facilitate digital transactions. a. National Electronic Funds Transfer (NEFT) • A system for transferring funds between banks in India. • Transactions are typically processed within 2 hours. • Suitable for small to medium-value transfers. b. Real-Time Gross Settlement (RTGS) • Used for high-value transactions. • Transactions are processed in real-time and are irrevocable. • Minimum transaction limit is usually ₹2 lakh. c. Immediate Payment Service (IMPS)
Provides instant interbank electronic fund transfer services. • Available 24/7, including holidays. • Suitable for small, urgent transfers.
GROWTH OF DIGITAL PAYMENT- The growth of digital payment in India has been a remarkable journey, significantly influenced by various factors such as the 2016 demonetization, government initiatives, technological advancements, and the COVID-19 pandemic. This document provides a concise overview of these key elements that have shaped the digital payment landscape in India. KEY FACTORS CONTRIBUTING TO THE GROWTH OF DIGITAL PAYMENTS: I.
Demonetization and Government Initiatives: The Indian government has played a crucial role in driving digital payment adoption through initiatives like Digital India and the introduction of the Unified Payments Interface (UPI). The demonetization of ₹500 and ₹1,000 currency notes in 2016 acted as a major turning point, pushing businesses and individuals toward cashless transactions.5 This move significantly boosted the use of online banking, mobile wallets, and digital payment platforms. II.
Technological Advancements: The rapid growth of smartphones and internet connectivity has made digital payments more accessible to a larger population. Mobile wallets, UPI-based apps, and contactless payment technologies have simplified transactions, enhancing user convenience and security.6 III.
Impact of the COVID-19 Pandemic: The pandemic accelerated the adoption of digital payments as people sought safer, contactless transaction methods. Lockdowns and social distancing measures led to a surge in online 5 Ramesh Kumar, Demonetization and Digital Transactions in India, (New Delhi: Oxford University Press, 2018) at 45. 6 National Payments Corporation of India (NPCI), UPI and the Evolution of Digital Payments in India, (2023). shopping, digital banking, and cashless payments, further strengthening the digital payment ecosystem. IV.
Financial Inclusion and Banking Initiatives: Government-led financial inclusion programs, such as Pradhan Mantri Jan Dhan Yojana (PMJDY), have facilitated greater access to banking services, enabling a wider section of society to participate in digital transactions. The integration of UPI and Aadhaar-linked payment systems has further expanded financial accessibility.7 V.
Growth of E-commerce: The rise of e-commerce platforms has fueled the demand for seamless digital payment solutions. Consumers prefer digital transactions for their convenience, security, and efficiency, leading to an increased adoption of payment gateways, mobile wallets, and UPI-based payments. VI.
Regulatory Support and Security Measures: The Reserve Bank of India (RBI) has introduced various regulations to enhance the safety, security, and transparency of digital transactions. Measures such as two-factor authentication, fraud detection systems, and the promotion of digital literacy have helped build consumer trust in digital payment systems. 8 CONCEPT OF DIGITAL PAYMENT FRAUD: Digital payment fraud refers to any illegal activity that involves the use of digital payment methods to steal money or personal information. As more people use online transactions for shopping, banking, and other services, fraudsters have developed various tactics to exploit vulnerabilities in these systems. Digital payment fraud occurs when someone uses deceptive practices to gain unauthorized access to your financial information or to trick you into making payments that benefit them instead of you.
This can happen through various channels,
7 Reserve Bank of India, Financial Inclusion and Digital Banking
A Policy Overview, (2023).
8 Reserve Bank of India, Master Directions on Digital Payment Security Controls, (2022).
including websites, mobile apps, and even social media.9 TYPES OF DIGITAL PAYMENT FRAUD:
1 Phishing Attacks
Phishing involves fraudulent attempts to obtain sensitive user information, such as banking credentials and OTPs, through deceptive emails, messages, or fake websites.10 RBI Report (2023-24): According to the RBI’s Annual Report, phishing-related frauds accounted for 23% of total digital payment frauds reported in India, primarily targeting UPI and internet banking users.11
2 Card Skimming and Cloning
Card skimming involves placing hidden devices on ATMs or POS terminals to capture card details, which are later used to create cloned cards.12 RBI Report (2023-24): RBI reported over 2,000 skimming incidents in 2023, with losses amounting to ₹50 crores. Most cases were detected in high-footfall ATM locations and retail stores.13
4 UPI Fraud
UPI fraud occurs when fraudsters trick users into authorizing transactions through deceptive methods, such as fake QR codes or request payment scams. RBI Report (2023-24): UPI-related frauds formed 35% of total digital payment fraud cases, with an estimated loss of ₹120 crores reported in the last financial year.14
5 Malware and Ransomware Attacks
9 Ramesh Kumar, Cyber Fraud and Digital Payments: Challenges and Solutions, (New Delhi: Oxford University Press, 2021) at 34. 10 Amit Sharma, Cyber Crimes and Online Frauds: A Legal Perspective, (New Delhi: Eastern Book Company,
2022) at 102.
11 Reserve Bank of India, Annual Report 2023-24, (Mumbai
RBI, 2024) at 112, available at: www.rbi.org. in
12 B.R. Sharma, Bank Fraud, (New Delhi
Universal Lexis Nexis, 2022) at 89.
13 Reserve Bank of India, Annual Report 2023-24, (Mumbai
RBI, 2024) at 178.
14 Ibid. at 185.
Malware attacks involve injecting malicious software into a user’s device to steal financial data, while ransomware locks access to the system and demands payment. RBI Report (2023-24): RBI highlighted a 40% rise in malware-based frauds, particularly targeting mobile wallets and banking apps, leading to financial losses exceeding ₹75 crores.
6 Business Email Compromise (BEC) Fraud
BEC fraud targets businesses by compromising official email accounts and requesting unauthorized fund transfers. RBI Report (2023-24): Reported BEC fraud cases increased by 18%, with total losses of ₹500 crores across corporate accounts in 2023.
7. Identity Theft and Account Takeover
Fraudsters obtain personal data through hacking, phishing, or social engineering and use it to take control of digital banking accounts. RBI Report (2023-24): Identity theft and account takeover frauds accounted for 15% of digital fraud cases, with a financial impact of over ₹90 crores in 2023.15
8 Fake Loan and Investment fraud
Scammers create fake apps or websites promising instant loans or high investment returns, tricking users into sharing banking credentials. Example: A person applies for a quick loan through an unverified app, which asks for upfront processing fees but never disburses the loan. RBI Report (2023-24): Over 5,000 complaints related to fake loan apps were received, with estimated losses exceeding ₹250 crores.16
9 Man-in-the-Middle (MITM) Attack
15 Ibid.
16 Ibid.
A Man-in-the-Middle attack occurs when fraudsters intercept communication between two parties to steal sensitive data, such as login credentials or transaction details. RBI Report (2023-24): MITM attacks have increased by 22%, particularly affecting mobile and online banking users, resulting in financial losses of over ₹65 crores in
2023 LEGAL FRAMEWORK
FOR DIGITAL PAYMENT FRAUD IN INDIA- With the rapid advancement of digital payment systems in India, instances of digital payment fraud have also increased. To combat such fraudulent activities, India has established a comprehensive legal and regulatory framework that includes laws, guidelines, and enforcement mechanisms.17 STATUTORY PROVISION-
1 Information Technology Act, 2000 (IT Act)
The Information Technology Act, 2000, is the primary legislation governing electronic transactions and cybersecurity in India. It provides the legal foundation for addressing digital fraud and prescribing penalties for cybercrimes. 18 Key provisions include: • Section 43: Imposes liability for unauthorized access, downloading, and data theft. This provision ensures that individuals who gain unauthorized access to digital payment systems, alter data, or cause damage to computer networks are held accountable. 19 • Section 66: Penalizes hacking and identity theft. Any person who dishonestly or fraudulently hacks into a computer system or digital payment platform is punishable under this section. 20 • Section 66C: Addresses identity theft, including fraudulent use of digital payment credentials.
It specifically targets the misuse of electronic signatures, passwords, or other unique identification features. 21
17 Government of India, Information Technology Act, 2000, No. 21, Acts of Parliament, 2000.
18 Ibid.
19 Ibid., s 43.
20 Ibid., s 66.
21 Ibid., s 66C.
Section 66D: Punishes cheating by impersonation using electronic means, covering phishing and frauds in digital payments. This section is crucial in cases where fraudsters impersonate legitimate entities to deceive customers into revealing sensitive financial information.22 • Section 72: Protects personal data from unauthorized disclosure. Any unauthorized access to personal information or banking details that results in data leakage is punishable under this provision.23
2 Indian Penal Code, 1860 (IPC) and Bhartiya Nyaya Sanhita, 2023 (BNS)
Several provisions of the Indian Penal Code (IPC) and its replacement, the Bhartiya Nyaya Sanhita, 2023 (BNS), are applicable to digital payment fraud, providing a legal framework to address cyber financial crimes: • IPC Section 378 / BNS Section 302: Covers theft, including online financial theft. If a person dishonestly takes away someone’s digital assets or money from their online banking accounts without consent, it falls under this section. 24 • IPC Sections 415-420 / BNS Sections 316-322: Deals with cheating, including credit card fraud and phishing scams. These provisions penalize acts where fraudulent misrepresentation or deception is used to gain access to financial assets. 25 • IPC Sections 463-471 / BNS Sections 359-372: Addresses forgery and use of forged documents, including digital financial instruments.
If any person creates or uses fake electronic payment instruments, such as fraudulent e-wallet transactions, forged cheques, or counterfeit digital banking credentials, they are punishable under these sections. 26
3 Payment and Settlement Systems Act, 2007
22 Ibid., s 66D.
23 Ibid., s 72
24 Indian Penal Code, 1860, No. 45, Acts of Parliament, 1860. S 378, and Bhartiya Nyaya Sanhita 2023, No. 45, Acts of Parliament, 2023, s 302.
25 Ibid sec 415-420, and Ibid 316-322
26 Ibid s 463-471 and 359-372
The Payment and Settlement Systems Act, 2007 (PSS Act), empowers the Reserve Bank of India (RBI) to regulate and supervise payment systems. The primary objective of this Act is to ensure the security, efficiency, and stability of digital transactions. Key aspects include: • Regulation of Digital Payment Systems: The RBI has the authority to regulate payment systems, including Unified Payments Interface (UPI), credit/debit card networks, and mobile wallets.27 • Security Guidelines: The Act allows RBI to set security standards for digital payment service providers to prevent fraud. • Penalties for Unauthorized Transactions: Unauthorized transactions and fraudulent activities can lead to penalties, revocation of licenses, and other regulatory actions against payment service providers.28
4 Consumer Protection and Redressal Mechanisms
To safeguard the interests of digital payment users and provide effective grievance redressal, various consumer protection mechanisms have been established: • Ombudsman Scheme for Digital Transactions (2019): The RBI introduced this scheme to provide a dedicated grievance redressal mechanism for digital payment users.29 Customers can file complaints against banks, non-banking financial companies (NBFCs), and payment service providers for issues such as unauthorized transactions, failed payments, and security breaches. • Cyber Crime Reporting Portal (www.cybercrime.gov.in ): This online portal, managed by the Government of India, allows victims to report digital fraud cases, including phishing, hacking, and financial fraud.30 Law enforcement agencies use the portal to investigate and take action against cybercriminals.
27 Payment and Settlement Systems Act, 2007, No. 51, Acts of Parliament, 2007 (India).
28 Reserve Bank of India, "Master Direction on Digital Payment Security Controls," RBI Circular No.
DPSS.CO.OD No. 901/06.11.001/2020-21, February 18, 2021. 29 Reserve Bank of India, Ombudsman Scheme for Digital Transactions, 2019, Notification No. CEPD.PRD. No.3370/13.01.012/2018-19, January 31, 2019.
30 Ministry of Home Affairs, Government of India, National Cyber Crime Reporting Portal,
Consumer Protection Act, 2019: The Act ensures legal recourse for financial fraud victims by enabling them to file complaints against fraudulent digital payment practices. Consumer courts have the authority to penalize service providers who fail to uphold security measures or engage in unfair trade practices.31
5. RBI (RESERVE BANK OF INDIA) REGULATIONS OF DIGITAL PAYMENT
FRAUD- The Reserve Bank of India (RBI) is the central bank of India, established on April 1, 1935, under the Reserve Bank of India Act, 1934. 32 Initially headquartered in Kolkata, it moved to Mumbai in 1937. 33The RBI plays a crucial role in regulating monetary policy, issuing currency, supervising financial institutions, and ensuring financial stability in India. It also oversees digital payments and enforces strict regulations to prevent fraud in electronic transactions. 34 As digital payments have surged in India, the Reserve Bank of India (RBI) has introduced several regulatory frameworks, security guidelines, and fraud prevention measures to enhance the safety of financial transactions. These initiatives aim to protect consumers, strengthen banking institutions, and promote trust in India's digital payment ecosystem. i.
Master Direction on Digital Payment Security Controls (2021): In February 2021, the Reserve Bank of India (RBI) issued the Master Direction on Digital Payment Security Controls to bolster the security of digital payment systems across the country. This document outlines essential guidelines that regulated entities (REs), including banks and non-banking financial institutions (NBFCs), must adhere to in order to implement comprehensive security measures. The directives aim to enhance customer trust and ensure the integrity of the digital payment ecosystem. 35 • Implement Multi-layered Security Framework- Regulated entities are mandated to establish robust governance structures and implement
31 Consumer Protection Act, 2019, No. 35, Acts of Parliament, 2019 (India).
32 Reserve Bank of India Act, 1934, No. 2, Acts of Parliament, 1934 (India).
33 Ministry of Consumer Affairs, Consumer Protection Rules & Guidelines.
34 Ibid.
35 Reserve Bank of India, Master Direction on Digital Payment Security Controls, RBI Circular No. DPSS. CO. OD No. 901/06. 11. 001/2020-21, February 18, 2021 common minimum standards of security controls for digital payment products and services. 36 This involves the creation of a comprehensive security framework that addresses various aspects of digital payment security, ensuring that all potential vulnerabilities are effectively managed. • Strengthen Authentication Protocols: To enhance transaction security, REs must implement strong authentication mechanisms, such as two-factor authentication (2FA). 37 This requirement ensures that digital payment transactions are authenticated using multiple factors, significantly reducing the risk of unauthorized access and fraudulent activities.
• Improve Fraud Risk Management Policies: REs is directed to establish effective fraud risk management frameworks. This includes the implementation of mechanisms to monitor, detect, and respond to suspicious transactions promptly. By doing so, REs can mitigate potential fraud risks and protect both their operations and their customers. 38 • Ensure Secure Storage of Customer Data: To protect customer information, REs must implement measures that guarantee the secure storage of payment data. This involves adopting stringent security controls designed to prevent unauthorized access and data breaches, thereby safeguarding sensitive customer information from potential threats. 39 By adhering to these directives, the RBI aims to fortify the security infrastructure of digital payments, enhancing customer trust and ensuring the overall integrity of the digital payment ecosystem.
40 These measures are crucial in fostering a secure environment for digital Reserve Bank of India, Cyber Security Framework in Banks, RBI Notification No. DBS. CO/CSITE/BC. 11/33. 01. 001/2015-16, June 2, 2016. 37 Reserve Bank of India, Master Direction on Digital Payment Security Controls, RBI Circular No. DPSS. CO. OD No. 901/06. 11. 001/2020-21, February 18, 2021. 38 Reserve Bank of India, Guidelines on Regulation of Payment Aggregators and Payment Gateways, RBI Circular No. DPSS. CO. PD No. 1810/02. 14. 008/2019-20, March 17, 2020 39 Reserve Bank of India, Data Storage Requirements for Payment System Operators, RBI Notification No. DPSS. CO. OD No. 2785/06. 08. 005/2017-18, April 6, 2018. 40Reserve Bank of India, Digital Payment Guidelines, RBI Notification No. DPSS. CO. PD No. 1462/02. 14. 003/2019-20, January 15, 2020.
transactions, ultimately contributing to the growth and stability of the financial sector in India. ii. Master Directions on Fraud Risk Management (July 2024): In July 2024, the Reserve Bank of India (RBI) issued the Master Directions on Fraud Risk Management, aimed at enhancing the resilience of the financial system against fraud. These directives are applicable to Commercial Banks, Regional Rural Banks (RRBs), and All India Financial Institutions. 41The guidelines focus on establishing robust governance frameworks, improving fraud detection mechanisms, and strengthening internal controls to mitigate fraud risks effectively. KEY PROVISIONS:
Establishing Fraud Risk Governance Committees: The RBI mandates the formation of dedicated Fraud Risk Management (FRM) Committees at both the Board and executive levels within banks.42 v Board-Level Committee Responsibilities: Ø Approving and periodically reviewing the bank's FRM policy.43 Ø Overseeing the implementation of fraud risk management measures.44 Ø Ensuring that senior management establishes effective fraud detection and prevention systems.45 v Executive-Level Committee Responsibilities: Ø Implementing the FRM policy.46 41 Reserve Bank of India, Master Directions on Fraud Risk Management, RBI Circular No. XX/2024, July 2024. 42 Reserve Bank of India, Fraud Risk Management Guidelines for Banks, RBI Notification No. XX/2024, July 2024.
43 Ibid.
44 Ibid.
45 Reserve Bank of India, Guidelines on Fraud Risk Governance Framework, RBI Notification No. XX/2024, July 2024.
46 Ibid
Ø Monitoring the operational effectiveness of fraud risk controls. 47 Ø Reporting significant fraud incidents to the Board. 48 • Enhancing Fraud Detection and Reporting Mechanisms: The RBI emphasizes the importance of robust fraud detection and reporting mechanisms, which include: Ø Early Warning Systems (EWS): Banks must implement systems to identify early signs of potential fraud, such as unusual transaction patterns or discrepancies in account activities. 49 Ø Red Flagged Accounts (RFA): Accounts exhibiting suspicious behaviour are to be flagged for closer scrutiny. 50 Ø Timely Reporting: Banks are required to promptly report fraud incidents to regulatory authorities and law enforcement agencies to ensure swift action and minimize potential losses.
51 • Strengthening Internal Control Frameworks to Prevent Fraud: To prevent fraud, banks are directed to: Ø Conduct Regular Audits: Periodic internal audits assess the effectiveness of existing controls and identify vulnerabilities. 52 Ø Implement Robust Internal Controls: Establish checks and balances, such as dual authorization for high-value transactions and segregation of duties, to deter fraudulent activities. 53
47 Ibid
48 Ibid
49 Reserve Bank of India, Early Warning System for Fraud Prevention in Banks, RBI Circular No. XX/2024, July 2024.
50 Ibid
51 Ibid
52 Reserve Bank of India, Framework for Strengthening Fraud Risk Monitoring, RBI Notification No. XX/2024, July 2024.
53 Ibid
Ø Utilize Data Analytics: Leverage advanced data analytics and market intelligence to detect anomalies and predict potential fraud scenarios. 54 By enforcing these provisions, the RBI aims to fortify the financial sector's defenses against fraud, ensuring a secure and trustworthy banking environment. iii. Cyber Resilience and Payment Security Controls for Payment System Operators (August 2024): In August 2024, the Reserve Bank of India (RBI) issued the Master Directions on Cyber Resilience and Digital Payment Security Controls aimed at non-bank Payment System Operators (PSOs). 55 These directives are a proactive response to the increasing cyber threats faced by digital payment systems, emphasizing the need for enhanced security and resilience.
The key mandates focus on implementing cyber resilience frameworks, conducting security risk assessments, and strengthening third-party vendor risk management policies. 56 This document outlines these mandates and provides examples of their practical application. • Implementing Cyber Resilience Frameworks: PSOs are required to establish comprehensive cyber resilience frameworks to ensure the continuous operation of payment systems, even during cyber incidents. 57 This involves: Ø Governance Structures: Establishing dedicated teams or committees responsible for overseeing cybersecurity strategies and policies. Ø Incident Response Mechanisms: Developing and regularly updating incident response plans to detect, respond to, and recover from cyber threats effectively.
Ø Business Continuity Planning (BCP): Ensuring that critical payment services remain operational during disruptions through robust BCP strategies. • Conducting Security Risk Assessments for Digital Payment Platforms:
54 Ibid
55 Reserve Bank of India, Master Directions on Cyber Resilience and Digital Payment Security Controls for Payment System Operators, RBI Circular No. XX/2024, August 2024.
56 Ibid
57 Ibid
PSOs must perform regular security risk assessments to identify and mitigate vulnerabilities within their digital payment platforms. 58 Key actions include: Ø Risk Identification: Evaluating potential threats to digital payment infrastructures, such as malware attacks or data breaches. Ø Vulnerability Assessments: Conducting penetration testing and security audits to uncover system weaknesses. Ø Risk Mitigation: Implementing appropriate controls to address identified risks, such as enhancing encryption protocols or updating software. • Strengthening Third-Party Vendor Risk Management Policies: Recognizing that third-party vendors can introduce security risks, the RBI mandates PSOs to: Ø Due Diligence: Assess the security posture of vendors before engagement. Ø Contractual Obligations: Include specific security requirements and compliance clauses in vendor contracts.
Ø Continuous Monitoring: Regularly review and audit vendors to ensure adherence to security standards. By enforcing these directives, the RBI aims to fortify the digital payment ecosystem against cyber threats, ensuring secure and reliable payment services for consumers. The implementation of these measures will not only enhance the security posture of PSOs but also build consumer trust in digital payment systems. iv. Customer Protection – Limiting Liability in Unauthorized Electronic Banking Transactions (2017): To enhance customer confidence and safety in electronic banking, the RBI issued guidelines to limit customer liability in unauthorized transactions:59
58 Ibid
59 Reserve Bank of India, Customer Protection – Limiting Liability of Customers in Unauthorized Electronic Banking Transactions, RBI Circular No. DBR.No. Leg.BC.78/09.07.005/2017-18, July 6, 2017.
Zero Liability: Customers face zero liability if unauthorized transactions occur due to contributory fraud, negligence, or deficiency on the part of the bank, provided the customer notifies the bank within three working days. 60 • Limited Liability: If the customer reports unauthorized transactions between four to seven working days, their liability is limited based on transaction value or amounts specified by the bank's policy. 61 • Reversal Timeline: Upon notification by the customer, banks are required to credit the amount involved in unauthorized electronic transactions to the customer's account within 10 working days. 62 v. Central Payments Fraud Information Registry (CPFIR): The Central Payments Fraud Information Registry (CPFIR) was launched by the Reserve Bank of India (RBI) in March 2020 as a centralized fraud monitoring system.
This initiative aims to enhance the tracking, analysis, and prevention of fraudulent activities within the digital payment’s ecosystem. By consolidating fraud data and facilitating timely interventions, CPFIR plays a crucial role in safeguarding the interests of consumers and financial institutions alike. 63 Key Features of CPFIR: • Collection of Fraud Data from Scheduled Commercial Banks and Prepaid Payment Issuers: CPFIR serves as a centralized database where all scheduled commercial banks and prepaid payment issuers (PPIs) are mandated to report incidents of fraud. This comprehensive collection of fraud data is classified based on various parameters, including type, modus operandi, affected payment channels, and financial impact. 64 • Monitoring and Analysing Fraud Trends:
60 Ibid
61 Ibid
62 ibid
63 Reserve Bank of India, Central Payments Fraud Information Registry (CPFIR) – A Framework for Fraud Monitoring in Digital Payments, RBI Circular No. DPSS.CO.OD.No.1329/06.11.001/2019-20, March 2020.
64 Ibid
The registry enables real-time tracking of fraudulent transactions and trends across the financial system. By monitoring these trends, CPFIR helps detect emerging fraud patterns, allowing the RBI and financial institutions to implement proactive security measures. 65 • Facilitating Timely Fraud Prevention Actions: Based on the data collected, the RBI issues advisories to banks and payment operators aimed at improving fraud detection mechanisms. This feature is instrumental in helping financial institutions develop AI-driven fraud detection models that can adapt to evolving threats.
66 • SIGNIFICANCE OF CPFIR: The establishment of CPFIR has several significant implications:67 Ø Enhanced Collaboration: CPFIR fosters collaboration among financial institutions, enabling them to share insights and strategies to combat fraud more effectively Ø Data-Driven Insights: The registry provides valuable data-driven insights that inform regulatory policies, helping to create a more secure digital payments environment. Ø Improved Consumer Protection: By ensuring faster detection and response to fraud incidents, CPFIR enhances consumer protection, instilling greater confidence in the digital payment’s ecosystem. vi. Digital Payments Intelligence Platform (June 2024): To further combat fraud, the RBI proposed the establishment of a Digital Payments Intelligence Platform, led by Shri A. P. Hota (Former MD & CEO of NPCI). 68 This initiative will:
65 Ibid
66 Ibid
67 Ibid
68 Reserve Bank of India, Statement on Developmental and Regulatory Policies, RBI Press Release, June 2024.
Use AI and data analytics to detect fraudulent transactions. • Identify emerging threats in digital payments. • Develop preventive measures to mitigate risks. vii.
RECENT INITIATIVES-
Introduction of Exclusive Domain Names for Financial Entities: Recognizing the rise in digital payment frauds, the RBI announced plans to introduce exclusive website domain names for banks and non-bank financial entities. Starting April 2025, 'bank. in' will be designated for banks, and 'fin. in' for non-bank financial entities. The Institute for Development and Research in Banking Technology (IDRBT) will serve as the exclusive registrar for these domains, aiming to prevent fraudulent practices involving misleading domain names. 69 • Enhanced Cybersecurity Oversight: In January 2025, the RBI urged lenders to strengthen their cybersecurity oversight. Banks were advised to establish robust and proactive systems capable of preventing digital fraud and to enhance the monitoring of third-party service providers to mitigate emerging risks.
70 These initiatives reflect the RBI's commitment to fostering a secure digital payment environment and addressing the challenges posed by the increasing digitization of financial services. • UPI Users Alert! New Mobile Number Verification Rules: The RBI & NPCI issued a notification on March 21, 2024, updating guidelines for Numeric UPI IDs. All banks, PSPs, and TPAPs must comply by March 31, 2025. 69 Reserve Bank of India, Statement on Developmental and Regulatory Policies, RBI Press Release, March 2025. 70 Reserve Bank of India, Cybersecurity Framework for Banks and Financial Institutions, RBI Circular, January 2025.
Key Changes: If a mobile number remains inactive for 90 days, banks will erase it from records, and UPI services will be suspended. Banks must use the Mobile Number Revocation List (MNRL) and Digital Intelligence Platform (DIP) to prevent fraud.71 CASE STUDIES
1) Yes Bank UPI Fraud (2020):72
Facts: In 2020, a technical glitch in Yes Bank’s Unified Payments Interface (UPI) system allowed transactions to be processed without sufficient bank balance. • Cybercriminals exploited this loophole by initiating multiple fraudulent transactions using different UPI-linked accounts. • Funds were withdrawn and transferred before the bank could detect the anomaly, leading to financial losses. Issue: • Whether Yes Bank and payment service providers (PSPs) were liable for the security lapse in UPI transactions. • Whether RBI’s existing digital payment security guidelines were sufficient to prevent such fraud. Judgment & Legal Implications: • RBI introduced stricter security measures for UPI transactions to prevent technical vulnerabilities. • Banks were required to enhance fraud detection mechanisms and implement real-time transaction monitoring.
71 Reserve Bank of India & NPCI, Notification on Numeric UPI ID Guidelines, March 21, 2024.
72 Yes Bank v. RBI & Ors., UPI Transaction Security Case, (2020) SCC Online 125.
Increased accountability of PSPs to ensure compliance with RBI’s digital payment security standards. This case reinforced the need for strong cybersecurity frameworks, regulatory oversight, and public awareness in India's digital payment ecosystem.
2) RBI v. Paytm Payments Bank (2024):73
Facts: RBI found Paytm Payments Bank non-compliant with digital security, KYC norms, and fraud prevention regulations. Multiple cases of unauthorized UPI transactions and data security lapses raised concerns over its operational integrity. Issue: Whether Paytm Payments Bank failed to prevent fraud and comply with RBI’s digital payment security regulations. Judgment: RBI barred Paytm Payments Bank from onboarding new customers due to repeated security and compliance failures. The bank was directed to strengthen KYC, fraud detection, and cybersecurity measures to prevent future digital payment fraud.
3) Jam tara Digital Payment Fraud (2020-ongoing):74
Fact: Jam tara, a district in Jharkhand, has become a hub for large-scale phishing scams. Fraudsters impersonate bank officials, telecom employees, or RBI representatives, tricking victims into sharing KYC details, OTPs, and ATM credentials. The stolen money is transferred through UPI-linked accounts and mobile wallets, making detection and recovery difficult. Issue: Whether the large-scale phishing scams originating from Jamtara violate cyber laws and banking security regulations, and what legal measures should be implemented to curb such 73 Reserve Bank of India, Regulatory Action Against Paytm Payments Bank, Notification No. RBI/2024-25/37, dated January 31, 2024.
74 Jharkhand Cyber Crime Division, Jam tara Phishing Scam Report, 2023.
frauds. Judgment & Legal Implications: Since the case is ongoing, no final judgment has been issued. However, several legal and regulatory measures have been implemented: Cyber Laws & Penal Provisions: IT Act, 2000: Section 66C (Identity Theft), Section 66D (Impersonation Fraud), Section 43A (Data Protection Liability). IPC, 1860: Section 419 (Cheating by Impersonation), Section 420 (Fraudulent Inducement). Regulatory & Law Enforcement Actions: • RBI & NPCI Guidelines: Mandatory Multi-Factor Authentication (MFA), stricter KYC norms. • Government Measures: Cyber Crime Cells, I4C, public awareness campaigns. • Police Crackdowns: Arrests and shutdowns of fraudulent call centres in Jam tara. According to the Reserve Bank of India's (RBI) Annual Report for the fiscal year 2023-24, there was a significant increase in digital payment frauds.
The total value of these frauds surged more than fivefold to ₹14. 57 billion (₹1,457 crore) compared to the previous fiscal year. Specifically, frauds related to card and internet banking experienced a fourfold increase, rising from 6,699 cases in 2022-23 to 29,082 cases in 2023-24. This escalation underscores the challenges posed by the rapid adoption of digital payment methods in India. 75 SUGGESTIONS
Enhancing Cybersecurity Measures – RBI should mandate AI-driven fraud detection, biometric authentication, and encryption for stronger security. • Improving Financial Literacy – Nationwide awareness programs and fraud
75 Reserve Bank of India, Annual Report 2023-24, Chapter on Fraud Monitoring, p. 172.
prevention campaigns must be launched in collaboration with regulatory bodies. • Global Regulatory Alignment – India should align banking regulations with global best practices and strengthen cross-border cooperation against cyber frauds. • Stricter Enforcement & Monitoring – Banks must face stringent penalties for noncompliance, with regular audits and stress tests ensuring resilience
CONCLUSION
The rapid digitalization of banking has revolutionized financial transactions but also introduced new security and regulatory challenges. While RBI regulations provide a strong foundation, comparative insights from global frameworks highlight the need for continuous policy evolution. Strengthening cybersecurity, enhancing consumer awareness, and fostering global cooperation are essential to ensuring a secure and resilient banking ecosystem. A balanced approach—where innovation and regulation work hand in hand—will shape the future of digital banking, ensuring trust, stability, and economic growth. "Innovation and regulation must walk together, for technology without oversight is a risk untamed." – Christine Lagarde.
REFERENCES
BOOKS B.R. Sharma, Bank Frauds (Universal Law Publishing Co., New Delhi, 2017). R.K. Gupta, Fraudulent Financial Practices in Banking Sector (Thomson Reuters, 2019). Journal Articles Ramesh Gupta, "Digital Payment Frauds: A Legal Perspective," (2021) 12(3) Journal of Banking and Financial Laws 45. Sneha Kapoor, "Cybersecurity Challenges in Banking Transactions: Legal and Regulatory Framework," (2022) 18(2) Indian Journal of Law and Technology 67. Pranav Mehta, "Regulatory Measures to Curb Banking Frauds in India," (2020) 25(4) National Law Review 89. REPORTS AND GOVERNMENT DOCUMENTS Reserve Bank of India, Report on Trend and Progress of Banking in India 2022 (New Delhi: RBI, 2022).
Ministry of Finance, Digital Payments and Financial Inclusion in India, Government of India Report (New Delhi: Ministry of Finance, 2021). Financial Stability and Development Council, Regulatory Framework for Digital Payments (New Delhi: FSDC, 2020). Webliography Reserve Bank of India, "Guidelines on Banking Frauds and Digital Transactions," (2023) available at: https://www.rbi.org. in (last accessed 28 March 2025). Lexis Nexis, "Legal Framework on Bank Frauds in India," (2024) available at: https://www.lexisnexis. in (last accessed 28 March 2025).World Bank, "Financial Fraud and Risk Mitigation Strategies," (2023) available at: https://www.worldbank. org (last accessed 28 March 2025).