UPI and digital banking fraud, mule accounts: what RBI expects

For digital banking fraud, Indian regulators expect a bank or payment provider to do four things: authenticate every payment properly, spot and restrict mule accounts, make the customer whole within fixed timelines when the customer is not at fault, and report incidents on time. The rules sit across RBI directions, NPCI circulars and CERT-In directions, and several of them changed in 2025 and 2026.

This guide sets out what each regulator asks for as of November 2026 and which dates matter next.

Who sets the rules for digital banking fraud

No single document covers UPI fraud. A compliance team has to read at least five sources together.

RBI consolidated its older circulars into function-wise directions on 28 November 2025, so the 2017 circular numbers many teams still quote now live inside the consolidated directions.

Customer liability: the 2017 rules and what replaces them

RBI's circular of 6 July 2017 on limiting customer liability in unauthorised electronic banking transactions introduced zero liability and limited liability. Under it, a customer has zero liability where the bank is at fault, and also for a third-party breach reported within three working days. Liability is capped for reports made in four to seven working days, and the bank's board policy applies after that. These rules were carried into the Responsible Business Conduct Directions, 2025.

In June 2026 RBI issued the Reserve Bank of India (Commercial Banks – Responsible Business Conduct) Third Amendment Directions, 2026. They apply to electronic banking transactions made on or after 1 January 2027. Until then the earlier provisions continue. Law-firm summaries of the final text describe these main changes:

• Wider scope. The framework now covers "fraudulent" transactions, including payments a customer made under coercion or deception, and not only transactions the customer never authorised.
• Burden of proof. The bank must examine and classify each complaint and prove customer negligence if it wants to deny relief.
• Zero liability. It applies where the bank is negligent, and for a third-party breach reported within five calendar days.
• Timelines. Banks have 45 calendar days to settle domestic cases and 60 for cross-border cases. Reversals are value-dated to the original transaction. Credit card disputes get a shadow reversal within five calendar days.
• Alerts and channels. SMS alerts for transactions above ₹500, email alerts where an address is registered, and 24x7 reporting channels.
• Small-value compensation. A bona fide individual or sole proprietor who loses up to ₹50,000 can receive, once in a lifetime, 85% of the net loss or ₹25,000, whichever is lower, if the fraud is reported to the bank and to the National Cyber Crime Reporting Portal or helpline 1930 within five calendar days. RBI, the customer's bank and the beneficiary bank share the cost. The mechanism covers transactions for one year from the effective date.

Parallel amendment directions were issued for other bank categories. Read the text that applies to your entity on rbi.org.in before changing policy wording.

Authentication directions for digital payments

The Authentication Mechanisms for Digital Payment Transactions Directions, 2025, issued on 25 September 2025, had a compliance date of 1 April 2026. They apply to payment system providers and participants, banks and non-banks alike.

• Every domestic digital payment needs at least two distinct factors of authentication, unless an exemption applies.
• For transactions other than card-present ones, at least one factor must be dynamically created or proven for that transaction. SMS OTP remains allowed, but it is no longer the only route.
• Issuers may add risk-based checks beyond two factors, using signals such as behaviour and device.
• Exemptions include small-value contactless card payments and recurring payments under the e-mandate framework.
• Card issuers had until 1 October 2026 to validate non-recurring cross-border card-not-present transactions where the overseas merchant asks for authentication.

The directions also deal with the issuer's responsibility to the customer when a transaction goes through without the required authentication. Read that paragraph alongside the customer liability rules above.

Mule account detection: what is expected

A mule account receives and moves the proceeds of fraud. RBI already expects banks to deal with mules through KYC and monitoring: customer due diligence at onboarding, risk categorisation, periodic KYC updates, monitoring for activity that does not fit the customer's profile, and suspicious transaction reports to FIU-IND.

Three developments add to this.

• MuleHunter.AI. The Reserve Bank Innovation Hub built this model to help banks identify mule accounts, and RBI announced it in December 2024. Press reports of a July 2026 reply in Parliament say 29 banks had onboarded it. In May 2026 the Indian Cybercrime Coordination Centre (I4C) signed an MoU with RBIH on it.
• Digital Payments Intelligence Platform (DPIP). RBI is building a shared platform for fraud intelligence across banks. As reported from the RBI Annual Report 2025-26, a first phase has been running since August 2025 and an AI-based risk-scoring phase is under development.
• A standard procedure for debit holds. On 11 September 2026 RBI published the Draft Reserve Bank of India (Know Your Customer) Amendment Directions, 2026. The draft follows a Supreme Court direction of 4 August 2026 and sets out a procedure for temporary debit holds on amounts or accounts linked to mule activity and cyber-enabled fraud. Comments closed on 2 October 2026. Check rbi.org.in for the final version.

RBI has also advised banks to integrate the Department of Telecommunications' Financial Fraud Risk Indicator, which grades mobile numbers as medium, high or very high risk.

These tools support a bank's own fraud detection system. They do not replace it. Responsibility for onboarding and monitoring stays with the bank.

NPCI measures for UPI fraud

NPCI changes UPI rules through operating circulars addressed to member banks, PSPs and third-party apps. Recent fraud-related measures include:

• P2P collect requests stopped. Person-to-person "collect" (pull) requests are not processed from 1 October 2025. Merchant collect requests continue.
• Verified beneficiary name. Under a circular of April 2025, apps must show the payee's name as held in the bank's records before the user pays, and must not let users edit it.
• Recycled mobile numbers. From April 2025, banks and apps are expected to refresh their records regularly against the Mobile Number Revocation List, so that UPI IDs do not stay linked to numbers that have been given up or reassigned.

NPCI circulars are short and frequent. Missing one usually shows up as a product non-compliance, not as a legal breach, but the customer impact is the same.

Incident and fraud reporting

Three reporting duties run in parallel.

1. CERT-In. The directions of 28 April 2022 under section 70B(6) of the Information Technology Act require specified cyber incidents to be reported within six hours of noticing them, and ICT logs to be kept for 180 days within Indian jurisdiction.
2. RBI. Regulated entities report cyber incidents to RBI under its cyber security instructions, and report frauds through Fraud Monitoring Returns under the Fraud Risk Management Directions, which RBI reissued entity-wise on 31 July 2026.
3. Law enforcement and FIU-IND. Customers are directed to the National Cyber Crime Reporting Portal and 1930. Banks file suspicious transaction reports under the PMLA framework.

How RegIntel Nexus helps

RegIntel Nexus does not detect fraud, monitor transactions or screen customers. It helps the compliance team keep track of the rules described above. The platform monitors publications from RBI, NPCI, FIU-IND and CERT-In, classifies each circular and tracks amendments such as the 2026 changes to customer liability. Its research assistant answers questions with the document, clause and page cited. Each requirement becomes a clause-level obligation with an owner, a due date, a status and an escalation path, mapped to the processes and applications it affects. Source versions, approvals and SHA-256 integrity records are kept as audit evidence.

This article is general information for compliance and risk professionals. It is not legal advice. Regulations are amended often; check the current text published by the regulator before acting.