RBI data for 2024-25 showed reported bank fraud of about ₹36,014 crore, up from ₹12,230 crore the year before. Much of the jump came from reclassified older cases. Card and digital payment fraud made up more than half of all fraud cases but a small share of value. These attacks are high in volume, low in value per case, and very hard on the customers they hit. Below are the patterns we see most often, with the controls that work against them.
UPI collect-request and QR scams
Fraudsters send “collect” requests or QR codes disguised as refunds, prizes or payments. The victim approves them by entering their UPI PIN, not realising that a PIN is only ever needed to send money.
- Controls: clear in-app warnings on collect requests, limits and cooling periods for new payees, risk scoring on collect requests from new or flagged VPAs, and showing the verified merchant name before PIN entry
Mule accounts
Stolen funds are moved quickly through chains of “mule” accounts, often rented from students or low-income account holders, before being cashed out or converted to crypto. RBI’s innovation hub built MuleHunter.AI to help banks detect them.
- Controls: behavioural analytics on new accounts (sudden inflow and outflow, many unrelated senders), velocity rules, device and IP linkage, video KYC quality checks, and fast information sharing with the I4C / 1930 helpline ecosystem
SIM swap and OTP interception
Attackers take over a victim’s mobile number with a fraudulent SIM replacement or call forwarding, then receive OTPs. RBI’s 2025 authentication directions push issuers beyond SMS OTP for exactly this reason.
- Controls: device binding, SIM-change signals from telecom operators, app-based or biometric factors, step-up authentication after device or SIM changes, and holds on high-risk transactions
Impersonation and “digital arrest” scams
Callers pose as police, CBI, customs, regulators or bank staff, and pressure victims into “verifying” funds by transferring them. Some keep victims on video calls for hours.
- Controls: customer education, friction and confirmation screens for unusually large or first-time transfers, and verified sender IDs and domains for bank communication
Malicious apps, remote access and phishing
Fake loan apps, screen-sharing tools and phishing sites harvest credentials, card data and OTPs, or take over the device outright.
- Controls: app hardening (root/jailbreak and overlay detection, anti-tampering), detection of screen-sharing apps during sensitive flows, brand and domain monitoring, and fast takedown processes
API and third-party risk
Fintechs rely on APIs, from partner banks, KYC providers and payment switches. Broken object-level authorisation, leaked keys and over-permissive partner access remain common audit and breach findings.
- Controls: an API inventory and gateway, strong client authentication (mTLS/OAuth), rate limiting, secrets management, partner access reviews, and regular API-focused VAPT
Building a fraud-resilient fintech
- Treat fraud and cyber security as one programme, sharing telemetry, device intelligence and incident response
- Instrument every customer journey with logging that meets CERT-In’s 180-day requirement and DPDP’s retention rules
- Run tabletop exercises for mass-fraud events, including regulator and CERT-In reporting within 6 hours
- Measure what matters: fraud loss per lakh transactions, time to block mule accounts, and customer reimbursement turnaround
Want an independent review of your fraud and security controls? Contact CyberQuotient.