Explore how Indian banks and NPCI use real-time machine learning and behavioral AI to combat UPI payment fraud, account takeovers, and mule account networks.
India runs more digital payments than almost any country on earth, and UPI is the biggest reason why. In FY2024-25, UPI processed 185.8 billion transactions, a jump of nearly 42% over the year before, and now makes up over 83% of all digital payment volume in the country. That kind of growth is a good problem to have, except fraud has grown right along with it.
The Reserve Bank of India's own annual report for FY2024-25 flagged a sharp rise in digital payment frauds, which made up 56.5% of all reported banking fraud cases that year, totaling around ₹520 crore. Zoom out further and the picture gets sharper: RBI data shows banking fraud losses jumped from about ₹2,623 crore in the April-September period of FY2023-24 to ₹21,367 crore in the same window a year later, an eightfold increase in value even though the number of cases rose by a comparatively modest 28%. A LocalCircles survey published in mid-2025 found that one in five families with a UPI user had experienced fraud at least once in the past three years, and more than half of the victims never even reported it.
The old way banks caught fraud, a fixed list of rules written by a risk team, simply cannot keep pace with numbers like these. That is why most Indian banks and fintechs have moved, or are actively moving, toward machine learning based fraud detection. This isn't a future trend sitting in a lab somewhere. NPCI already provides banks with a fraud monitoring solution that generates alerts and declines transactions using AI and ML based models, alongside other safeguards like device binding and two-factor authentication. Here's how the technology actually works, where it's already running, and what banks still need to get right.
Why Rule Based Fraud Systems Stopped Working
For years, banks caught fraud with simple, fixed rules: block any transaction above a certain amount, flag anything from a new device, freeze an account if it logs in from two cities in one day. These rules are cheap to build and easy to justify to a regulator or an auditor, which is exactly why banks relied on them for so long.
The trouble is that fraud rings study these rules and design around them. A transaction that stays just under the flagged limit, or one that gets broken into several smaller transfers instead of a single large one, slips through untouched. Meanwhile, genuine customers get blocked constantly for behavior that simply looks unusual on paper, like traveling for work, splitting a large purchase, or logging in from a new phone after an upgrade. Banks end up carrying both higher fraud losses and a flood of customer complaints, which is close to the worst possible combination for a financial institution trying to grow.
This gap is visible in the RBI's own numbers. Bank fraud cases actually fell by 34% in FY25 compared to the year before, dropping to 23,953 incidents, yet the total amount involved in those frauds nearly tripled to ₹36,014 crore. Fewer, larger, more sophisticated frauds are getting through, which is precisely the pattern you'd expect once fraud rings learn to work around static, rule based defenses.
What Changes With Machine Learning
Learning Normal Behavior Instead of Applying One Rule to Everyone
Instead of applying the same fixed threshold to every customer, ML models build an individual profile of what "normal" looks like for each account: typical spend range, regular merchants, common locations, and usual time of day for transactions. When a transaction breaks that personal pattern, the system flags it, even if the amount itself is well within the old fixed limit. This is exactly the kind of fraud that a rule based system, applying one blanket threshold to millions of customers, is structurally unable to catch.
Scoring Risk From Device and Behavior, Not Just the Transaction Itself
A large share of fraud today isn't a stolen card, it's a compromised login. Models increasingly look at device fingerprints, typing speed, how someone navigates an app, and login timing to build a dynamic risk score for the session itself, before a single rupee actually moves. This matters because account takeover fraud, along with mule accounts used to funnel stolen funds, has become a growing concern flagged directly by the RBI in its recent reporting on rising fraud losses. Catching the compromised session early is often the only way to stop the fraud before the transfer happens.
Spotting Coordinated Fraud Through Network and Graph Analysis
Individual transactions can look completely ordinary on their own and still be part of an organized, coordinated fraud operation. Graph based ML techniques map the relationships between accounts, devices, and beneficiaries, surfacing fraud rings that would never show up if each transaction were reviewed one at a time in isolation. This is particularly relevant in India given how frequently mule account networks are used to move stolen money quickly across multiple banks before it can be traced or frozen.
Scoring Transactions in Milliseconds
None of the above matters if it slows down a payment. UPI transactions clear in seconds, so fraud scoring has to happen inside that same window without the customer noticing any delay. Well built ML systems score a transaction and decide whether to approve it, block it, or trigger a step up authentication step, all within milliseconds. At a volume of nearly 17 billion UPI transactions in a single month, as recorded in January 2025 alone, there is simply no manual or rule based process that can operate at that scale and speed.
Where This Is Already Live in Indian Banking
UPI and real-time payments, where fraud scoring runs at extremely high volume and very low latency, often as the first line of defense before a transaction ever settles
Card transactions, where anomaly detection increasingly runs alongside older rule engines rather than replacing them outright, catching what the rules miss
Loan and credit onboarding, where identity and application fraud checks during KYC catch fraudulent applications before disbursal, not after
Account takeover prevention, using behavioral biometrics and device level risk scoring to catch compromised logins and mule account activity before funds move out
The government's own push in this direction is worth noting. Alongside NPCI's AI and ML based fraud monitoring solution provided to banks, the Ministry of Home Affairs runs the National Cybercrime Reporting Portal and the 1930 helpline specifically to get fraud reports and freeze requests moving faster, since every hour a stolen fund sits in a mule account increases the chance it disappears for good.
It's Not Just About Cutting Losses
Fraud prevention usually gets framed purely as a cost center, something a bank has to spend money on defensively. But done well, it also improves the customer experience, and that shows up directly in growth numbers too. In our work with Creditcure, combining fraud and risk scoring models with a smoother, lower friction onboarding flow helped cut customer acquisition cost by 32%. Fewer genuine customers were getting blocked, delayed, or asked for redundant verification steps, which meant more of them actually completed onboarding instead of dropping off midway. That's the part often missed in fraud AI conversations: a well tuned model doesn't just stop bad actors, it also lets good customers through faster.
What Banks Still Need to Get Right
Data quality: A fraud model is only as good as the transaction and behavioral data it's trained on. Gaps, inconsistencies, or stale data in that pipeline show up directly as either missed fraud or a wave of false alarms on genuine customers.
Explainability: Regulators expect a clear, auditable reason behind every flagged transaction or declined application. A model that can't explain its own decision in plain terms is a compliance problem waiting to surface, no matter how statistically accurate it is on paper.
Model drift: Fraud tactics shift constantly, and the RBI's own year over year numbers make that obvious, cases and loss values move in very different directions from one year to the next. A model trained a year ago is already behind. This isn't a one time build, it needs regular retraining against fresh data, not an annual refresh.
Integration without friction: A fraud model that adds even half a second of delay to a UPI transaction is not usable in production at Indian payment volumes. Scoring has to sit inside the existing transaction pipeline without becoming a bottleneck, which is as much an engineering challenge as it is a data science one.
Under-reporting: It's worth banks keeping in mind that official fraud numbers likely understate the real picture. The same LocalCircles survey found that 51% of UPI fraud victims never reported the incident at all, which means the true fraud rate sitting inside a bank's own customer base is probably higher than what shows up in national statistics.