What Happened
- The Reserve Bank of India (RBI) released a discussion paper proposing a suite of measures to tackle the sharp rise in digital payment frauds, including mandatory time lags, enhanced authentication for senior citizens, and a "kill switch" for instant payment freezes.
- Key proposal 1: Account-to-account transfers above ₹10,000 would be held for one hour at the payer's end before execution. Customers can cancel during this window; suspicious transactions require re-confirmation. Merchant payments, e-mandates, NACH transactions, and cheques are exempt. Customers can whitelist trusted payees to bypass the delay.
- Key proposal 2: Citizens aged 70 and above and persons with disabilities would be required to nominate a "trusted person" whose authentication becomes mandatory for transfers above ₹50,000.
- Key proposal 3: A one-click "kill switch" allowing customers to instantly freeze all digital payment channels.
- Key proposal 4: Accounts receiving large credits from multiple senders to be subject to enhanced scrutiny.
- Transactions above ₹10,000 account for ~45% of fraud cases by volume but approximately 98.5% of total fraud value.
- Citizens aged 70+ and persons with disabilities account for ~92% of total fraud value reported.
- The consultation period for feedback on the discussion paper closes on May 8, 2026.
Static Topic Bridges
RBI's Regulatory Framework for Digital Payments
The Reserve Bank of India is the regulator and supervisor of the payment and settlement systems in India under the Payment and Settlement Systems (PSS) Act, 2007. Section 10 of the PSS Act empowers the RBI to issue directions to system providers. The RBI also operates under the RBI Act, 1934 for monetary functions and the Banking Regulation Act, 1949 for bank supervision.
- PSS Act, 2007: Primary legislation for payment system regulation; establishes the Board for Regulation and Supervision of Payment and Settlement Systems (BPSS) within RBI
- NPCI (National Payments Corporation of India): Operates UPI, IMPS, NACH, RuPay — not directly regulated by PSS Act as an operator but as a subsidiary mechanism under RBI oversight; established under Section 25 of the Companies Act
- UPI: Unified Payments Interface launched in 2016 by NPCI; grew to over 10,637 crore transactions in H1 2025 (52x growth since 2019); now constitutes 99.8% of payment transactions by volume
- RBI's Master Direction on Digital Payment Security Controls (2021) mandated multi-factor authentication and risk-based transaction monitoring for banks and payment aggregators
- Ombudsman Scheme for Digital Transactions (OSDT): Grievance redressal mechanism for digital payment complaints; merged into the Integrated Ombudsman Scheme in 2021
Connection to this news: The RBI's discussion paper on payment cooling periods and trusted-person authentication represents the next evolution of its PSS Act powers — moving from reactive fraud response to proactive friction-based prevention, particularly targeting high-value and vulnerable-user transactions.
Customer Liability in Digital Payment Fraud — Current Framework
The RBI's existing guidelines on Limiting Customer Liability (circular dated July 6, 2017, updated over time) determine how much loss a customer bears when unauthorised digital transactions occur. The framework depends on whether the breach was due to bank negligence, third-party fraud, or customer negligence.
- If breach is due to bank negligence: Zero liability on customer, full reimbursement
- If breach is due to third-party fraud with prompt customer reporting (within 3 working days): Zero liability; bank reimburses fully
- If breach is due to customer negligence (sharing OTP, credentials): Full customer liability
- New proposal under discussion: Compensation of up to 85% of loss or ₹25,000 (whichever is lower) for small-value frauds reported promptly — shifting more liability to the banking system
- Digital fraud statistics: ~13,500 cases of card/internet fraud (₹520 crore) in 2024–25; UPI-related frauds: ₹485 crore in 6.32 lakh incidents in FY 2024–25
Connection to this news: The proposed ₹10,000 threshold cooling period and trusted-person requirement for senior citizens directly address the gap in the existing liability framework — preventing fraud before it occurs rather than compensating after, which is more protective of the 92% fraud value attributed to elderly/disabled victims.
Senior Citizens and Digital Financial Inclusion — Governance Angle
Senior citizens (aged 60+) represent a growing segment of India's population and are disproportionately targeted by digital fraudsters using impersonation, phishing, and social engineering. Protecting this group is both a consumer protection imperative and a constitutional duty under Article 41 (Right to work, education and public assistance in certain cases) and Article 47 (Duty of the state to raise the level of nutrition and standard of living — a DPSP).
- India's population aged 60+: approximately 149 million (2021 Census projection); projected to reach 347 million by 2050 (UN DESA)
- Maintenance and Welfare of Parents and Senior Citizens Act, 2007: Provides for maintenance tribunals and obligations of children; amended in 2019 to include provisions for digital safety and care
- Atal Pension Yojana (APY): Financial inclusion scheme for unorganised sector workers; not specifically for seniors
- The Digital Saksharta Abhiyan (DISHA) and successor programmes aimed at digital literacy do not specifically target senior citizens' fraud vulnerability
- The proposed "trusted person" model mirrors adult guardianship frameworks in elder law — bringing a welfare-state principle into digital payment architecture
Connection to this news: The RBI's proposal to mandate a trusted-person authentication for citizens 70+ is a regulatory recognition of the heightened vulnerability of the elderly in digital payment ecosystems — with implications for both banking regulation and elder welfare governance.
UPI and India's Digital Payment Infrastructure — Strategic Significance
India's Unified Payments Interface (UPI) has become a global model for real-time retail payment systems. Its scale, interoperability, and zero-cost structure for peer-to-peer payments represent a landmark in financial technology governance. However, scale also amplifies fraud exposure.
- UPI launched: April 11, 2016 (first live transaction); developed by NPCI on mandate from RBI
- UPI transaction volume in H1 2025: 10,637 crore transactions worth ₹143.3 lakh crore — 52x growth since 2019
- IMPS (Immediate Payment Service): 24/7 interbank transfer; also NPCI-operated; distinct from UPI (IMPS is bank-to-bank, UPI is account-agnostic via VPA)
- NACH (National Automated Clearing House): Bulk payment system for recurring transactions (salaries, EMIs, subsidies) — explicitly exempted from proposed cooling period
- India exported UPI to Singapore (UPI-PayNow linkage), UAE, France, Bhutan, Nepal, Sri Lanka — positioning it as a digital public infrastructure (DPI) export
- G20 Digital Payments Roadmap (2023, India's G20 Presidency): India championed cross-border DPI interoperability; UPI central to this agenda
Connection to this news: The proposed ₹10,000 cooling period applies to account-to-account transfers (IMPS/RTGS/NEFT) but not to merchant UPI payments — a deliberate design choice to prevent friction in high-frequency small commerce while targeting the high-value transactions where fraud value is concentrated.
Key Facts & Data
- Proposed payment cooling period: 1 hour for transfers above ₹10,000
- Trusted-person authentication threshold: transfers above ₹50,000 for citizens aged 70+ and persons with disabilities
- Transactions above ₹10,000: ~45% of fraud cases by volume, ~98.5% of total fraud value
- Elderly/disabled victims' share of total fraud value: ~92%
- UPI fraud losses (FY 2024–25): ₹485 crore across 6.32 lakh incidents
- Card/internet fraud (FY 2024–25): ~13,500 cases, ₹520 crore
- Public consultation deadline: May 8, 2026
- UPI transactions (H1 2025): 10,637 crore transactions, ₹143.3 lakh crore value
- UPI launch date: April 11, 2016
- PSS Act enactment year: 2007
- RBI Master Direction on Digital Payment Security Controls: 2021
- Proposed fraud compensation: up to 85% of loss or ₹25,000, whichever is lower
- New digital payment rules effective: April 1, 2026 (dynamic risk-based authentication)