What Happened
- The Reserve Bank of India (RBI) released a discussion paper on April 8, 2026, proposing a mandatory one-hour delay for digital payments above ₹10,000 to combat surging Authorised Push Payment (APP) frauds.
- Under the proposal, the bank would provisionally debit the payer's account but hold the transaction for one hour, during which the payer can cancel — targeting the window exploited by fraudsters.
- Transactions above ₹50,000 would require an additional "trusted contact" authentication step.
- A universal "kill switch" would allow users to instantly halt all digital payment channels simultaneously (UPI, cards, net banking) in case of compromise.
- Annual credit limits of ₹25 lakh would be imposed on low-KYC accounts to deter mule account operations.
- Exemptions are proposed for merchant transactions, recurring payments, and cheques; public feedback is invited until May 8, 2026.
Static Topic Bridges
Authorised Push Payment (APP) Fraud and the Scale of Digital Financial Crime
Authorised Push Payment (APP) fraud occurs when a victim is deceived into authorising a payment to a fraudster's account — unlike card skimming or hacking, the victim themselves initiates the transfer. Because the payment is "authorised," banks traditionally had no obligation to reverse it, leaving victims with little recourse. The rise of real-time payment systems globally (UPI in India, Faster Payments in the UK) has dramatically expanded the attack surface for APP fraud. In India, cases reported to the National Cyber Crime Reporting Portal (NCRP) rose from 2.6 lakh in 2021 to 28 lakh in 2025, while fraud value rose from ₹551 crore to ₹22,931 crore.
- High-value transactions above ₹10,000 represent 45% of APP fraud cases by volume and 98.5% by value.
- Transactions above ₹50,000 account for 92% of total fraud value.
- Mule accounts — bank accounts opened by or controlled by money launderers — channel 30-40% of laundered funds; rural individuals are often recruited with commissions.
- The UK's Payment Systems Regulator introduced mandatory APP fraud reimbursement rules in October 2023, requiring banks to reimburse victims up to £85,000.
Connection to this news: The one-hour delay proposal directly targets the APP fraud mechanism — creating a "cool-off" period where a victimised user can cancel the fraudulent payment before it reaches the fraudster's account.
RBI's Regulatory Framework for Digital Payments
The Reserve Bank of India regulates India's payment and settlement systems under the Payment and Settlement Systems (PSS) Act, 2007. This Act empowers RBI to authorise, regulate, and supervise all payment systems in India, covering RTGS (large-value), NEFT (batch electronic), UPI (mobile instant), card networks, and mobile wallets. The Board for Regulation and Supervision of Payment and Settlement Systems (BPSS), chaired by the RBI Governor, formulates policies for the sector.
- The National Payments Corporation of India (NPCI) was established in 2008 under the PSS Act, jointly by RBI and the Indian Banks' Association (IBA), as the retail payments operator.
- NPCI operates UPI, IMPS, NETC (FASTag), NACH, RuPay, and BBPS among others.
- India processes over 250 billion UPI transactions annually (as of 2025), representing approximately 50% of global real-time digital payment volume.
- RBI's Vision Document 2025 emphasised "safe and secure" payments as a core objective alongside financial inclusion.
Connection to this news: The discussion paper is issued under RBI's authority as payment system regulator, illustrating how rapid growth of UPI requires equally rapid evolution of fraud safeguards — the same regulatory framework that enabled UPI's scale now needs to be used to protect it.
Mule Accounts and Financial Crime Ecosystem
Mule accounts are legitimate bank accounts that are used (knowingly or unknowingly) to receive and transfer proceeds of fraud. Account holders — often recruited via social media with promises of commissions — allow their accounts to be used to "wash" stolen funds. The RBI's proposal to cap annual credit limits on low-KYC accounts at ₹25 lakh is specifically aimed at limiting the capacity of mule accounts to channel large fraud proceeds. The Financial Intelligence Unit-India (FIU-IND) under the Ministry of Finance plays a key role in detecting suspicious transactions linked to mule accounts.
- Low-KYC accounts (small/minimum KYC) have limited documentation requirements under the Prevention of Money Laundering Act (PMLA) framework, making them easier to set up for illicit purposes.
- RBI's 2023 guidelines required banks to flag accounts with patterns consistent with mule behaviour (large inflows immediately followed by complete withdrawals).
- The RBI's MuleHunter.AI tool was mentioned in the Annual Report 2024-25 as an AI-based detection system being piloted to identify mule accounts using transaction behaviour analysis.
Connection to this news: The ₹25 lakh annual cap on low-KYC account credits targets the mule account ecosystem directly — by limiting the throughput capacity of accounts most commonly used to receive and re-route fraud proceeds.
Key Facts & Data
- Cyber fraud cases (NCRP): 2.6 lakh (2021) → 28 lakh (2025) — a ~10x rise
- Fraud value: ₹551 crore (2021) → ₹22,931 crore (2025)
- Transactions above ₹10,000 = 45% of APP fraud cases by volume; 98.5% by value
- Proposed one-hour delay applies to: transactions above ₹10,000 (individual payers)
- Trusted contact authentication: transactions above ₹50,000
- Annual credit cap for low-KYC accounts: ₹25 lakh
- Kill switch: universal halt across UPI, cards, net banking
- PSS Act, 2007: primary legislation for payment system regulation in India
- NPCI established: 2008; operates UPI, RuPay, NACH, IMPS, NETC
- Public comment deadline on RBI discussion paper: May 8, 2026