UPI-related frauds have surged by 85%, rising from 725,000 cases in FY23 to 1.34 million cases in FY24. While UPI has transformed India’s digital payment landscape, the spike in fraud follows a familiar trajectory. As financial systems evolve, from counterfeit currency to forged cheques, and now digital transactions, so do the methods of exploitation.
Launched in 2016 by the National Payments Corporation of India (NPCI), UPI has redefined how payments are made. It has made money transfers faster and more efficient by seamlessly connecting multiple bank accounts through a mobile application. In January 2025, UPI transactions reached ~17 billion in volume and ~US$282 billion in value – the highest in a single month.
Emerging Risks and Vulnerabilities
While digital convenience has undoubtedly transformed the payment landscape, it has simultaneously opened new avenues for financial misconduct. The very nature of UPI enables rapid movement of funds, which fraudsters can exploit in various ways. This evolution has simplified all three stages of money laundering: placement, layering, and integration. It allows illicit funds to be easily placed into the system, layered through multiple transfers, and integrated into the economy, often without detection.
Types of Risks
The swift growth has introduced several critical risks, particularly in financial crime and money laundering, that demand urgent attention from regulators, financial institutions, and technology providers:
1. Phishing Attacks: Cybercriminals trick users into revealing their UPI PINs or credentials via fake websites or applications, which are then used to siphon funds as part of broader money laundering schemes.
2. Transaction Laundering: Fraudsters set up fake merchant accounts or collaborate with shell companies to route illegal funds, making them appear as legitimate transactions, thereby bypassing regulatory scrutiny.
3. Micro-structuring: Large sums of illicit money are broken down into smaller, seemingly inoffensive UPI transactions across multiple accounts, designed to stay below reporting thresholds and avoid detection.
4. Synthetic Identity Fraud: By combining real and fabricated information, fraudsters open UPI-linked accounts under fictitious identities, facilitating the movement of illicit funds without raising suspicion.
5. Money Mule Networks: Scammers recruit individuals, sometimes unknowingly, to receive and transfer stolen or illicit funds through their UPI accounts, masking the source and obscuring the financial trail.
6. Cryptocurrency Convergence: Illicit funds are funnelled through UPI into cryptocurrency exchanges, where they are converted into digital assets, making the financial trail harder to trace and regulate.
Fraud prevention through enhanced KYC
Since 2022-23, UPI-related frauds have led to cumulative losses of over US$21 billion across 2.7 million reported incidents, highlighting the vulnerabilities in digital payment systems. While traditional identity checks and video KYC offer a quick and convenient way to onboard users, they are often insufficient to detect deeper financial risks. These methods validate identities at a single point in time without assessing behavioural patterns, transaction history, or ownership structures.
Open Data Intelligence and Enhanced KYC, supported by automation and due diligence, offers a dynamic defence against money laundering. With real-time risk monitoring, ownership analysis, and anomaly detection, it empowers financial institutions to proactively identify threats and mitigate the risk of financial crimes.
The road ahead
As UPI continues to redefine convenience in financial transactions, strengthening its security framework becomes imperative. To secure its future, India must tighten KYC norms, deploy AI-driven fraud detection, and boost user awareness. Discussions at the FATF forum, held in March, highlighted the need for clear frameworks to support the global expansion, particularly for cross-border payments and for use while travelling abroad.
The rise of real-time digital payment systems like UPI represents an unparalleled advancement in financial technology, offering convenience and efficiency. However, with any new technological innovation, it introduces new risks and vulnerabilities. As the digital payment landscape continues to evolve, so must our defences against financial misconduct. A combination of intelligent fraud detection systems, rigorous regulation, and heightened user awareness is essential to safeguard the integrity of digital financial ecosystems, both in India and globally.
