India Cracks Down: Stricter Rules To Combat Rising Digital Payments Fraud

India has launched a sharp clampdown on online payment scams, ordering tougher checks and new rules that aim to cut the rising tide of fraud. Based on reports, regulators and payment networks moved after authorities recorded big jumps in both the number of cases and the money lost to scams last year.

India: RBI And NPCI Move Fast

Regulators have pushed several changes into the banking and payments system. According to published figures, incidents tied to Unified Payments Interface or UPI more than doubled from about 7.25 lakh ($8,700) to 13.42 lakh ($16,200) in fiscal year 2023-24.

Reported losses rose too, from ₹573 crore ($69 million) the year before to ₹1,087 crore ($131 million) in 2023-24. The central bank has allowed risk-based additional checks for certain transactions, and NPCI has told banks and apps to block pull or collect requests on UPI from October 1, 2025, a move meant to shut a common scam vector.

The Reserve Bank of India (@RBI) releases new guidelines on authentication for #digital payment transactions, set to take effect from April 1, 2026.

The framework mandates two-factor authentication for all digital payments, though no specific method is enforced.

The central… pic.twitter.com/NH7xKuMmzm

— All India Radio News (@airnewsalerts) September 25, 2025

New Authentication And Domain Rules

One of the headline changes is a requirement for two-factor authentication for payments, set to come into effect on April 1, 2026. Banks and payment firms will need to apply at least two methods of ID for transactions — such as biometrics, device tokens, or passphrases — while SMS OTPs will still be allowed in some cases.

Reports also say the industry will be asked to reserve clear, trusted web domains for banks and finance firms — examples given include “bank.in” for banks and “fin.in” for non-bank financial companies — to make phishing sites easier to spot and block.

The new rules are meant to stop impersonation scams, fake calls that pretend to be law enforcement, and other social engineering tricks that send money out of accounts.

A special Cyber Fraud Mitigation Centre and the Indian Cyber Crime Coordination Centre will coordinate responses, and a suspect registry drawn from the national cybercrime portal is being used to track suspicious accounts and identities.

Banks and small operators that run Aadhaar-enabled payment services will face stricter due diligence requirements for their agents and terminals.

Banks and tech providers must upgrade systems to run the extra checks and keep records. That will add cost and complexity, especially for smaller firms and rural operators that rely on older devices.

Users may face more steps when they pay, particularly for cross-border or unusual transactions. Reports warn that fraudsters often change tactics after rules tighten, so the measures will need constant review and active enforcement to stay effective.

Featured image from Unsplash, chart from TradingView