India’s fintech sector has grown rapidly, with the Unified Payments Interface (UPI) handling approximately 2,366 crore transactions worth ₹29.87 lakh crore in July 2026. As digital finance becomes increasingly ordinary, the importance of cybersecurity has grown, with a significant rise in cyber incidents from 10.29 lakh in 2022 to 22.68 lakh in 2024.
Cybersecurity incidents have resulted in significant financial losses, but the national cyber fraud reporting system has helped save over ₹5,489 crore across more than 17.82 lakh complaints. The speed of response to these incidents has become important in determining the actual cost of fraud to households.
Regulatory Measures
Regulators have taken steps to strengthen cybersecurity, moving from best practices to binding requirements. The Computer Emergency Response Team (CERT-In) has directed that specified incidents be reported within six hours, and system logs be kept for 180 days within India. The Reserve Bank of India (RBI) has also introduced a Master Direction on IT governance, requiring a board-level IT strategy committee and a security chief independent of the IT function.
The Digital Personal Data Protection Rules, 2025, give organizations 18 months to comply, with penalties of up to ₹250 crore for failing to maintain reasonable security safeguards. The RBI’s authentication directions for digital payments, effective April 2026, allow issuers to add risk-based checks beyond the SMS OTP, emphasizing accountability and demonstrating security rather than just claiming it.
Shared Intelligence and Collaboration
Most fraud starts with a phone call, fake link, or borrowed bank account, rather than a breached server. As no single institution can stop it alone, the focus is shifting to shared intelligence. The RBI’s MuleHunter.AI is live in 26 banks, and the Indian Digital Payment Intelligence Corporation was set up in October 2025 to tackle payment fraud at a system level.
The RBI has also proposed revising its rules on customer liability for unauthorized transactions, including compensation for small-value frauds. If finalized, firms that fail to stop preventable fraud may increasingly bear its cost, highlighting the importance of security as part of the product.
Security and Trust
Security must be proportionate, invisible for routine activity, firm when behavior looks unusual, and clear about why a transaction was paused. Communication matters, and an incident disclosed promptly and plainly can leave trust intact. Artificial intelligence will sharpen both sides, with tools helping institutions spot anomalies and fraudsters clone voices and run personalized scams cheaply.
Leave a Reply