Daybreak - As UPI transactions hit record-high, it's time to get your guard up

Episode Date: January 8, 2024

2023 turned out to be a landmark year for UPI (Unified Payments Interface) with the number of transactions crossing the 100-billion mark for the first time, according to the latest data released by the NPCI. The month of December alone saw more than 12 billion transactions. These numbers are testament to how UPI has revolutionized the way we use money. As of now, there are more than 300 million users in India are using UPI to freely carry out their financial transactions with each other.  But did you know that your bank can block your account without a warning or any explanation based on your UPI transactions? And what's worst, you could even come under the radar of law enforcement authorities like the cyber crime police. Anyone who unknowingly makes a transaction, directly or indirectly, with a fraudster can be considered suspicious by authorities.  Meanwhile, banks and law enforcement agencies still haven't managed to figure out a standard operating procedure in dealing with such matters. This had led them to adopt a ‘block first, ask questions later’ approach that's been making the lives of innocent victims of financial crimes even harder.  Tune in.Daybreak is produced from the newsroom of The Ken, India’s first subscriber-only business news platform. Subscribe for more exclusive, deeply-reported, and analytical business stories.   

Hi, this is Rohan Dharma Kumar. If you've heard any of the Ken's podcasts, you've probably heard me, my interruptions, my analogies, and my contrarian takes on most topics. And you might rightly be wondering why am I interrupting this episode too. It's for a special announcement. For the last few months, I and Sita Raman Ganeshan, my colleague and the Ken's deputy editor, have been working on an ambitious new podcast. It's called Intermission.

We want to tell the secret sauce stories of India's greatest companies. Stories of how they were born, how they fought to survive, how they build their organizations and culture, how they manage to innovate and thrive over decades, and most importantly, how they're poised today. To do that, Sita and I have been reading books, poring over reports, going through financial statements, digging up archives, and talking to dozens of people. And if that wasn't enough, we also decided to throw in video into the mix. Yes, you heard that right. Intermission has also had to find its footing in the world of multi-camera shoots in professional studios, laborious editing, and extensive post-production. Sita and I are still reeling from the intensity of our first studio recording.

Intermission launches on March 23rd. To get alert, as soon as we release our first studio. episode, please follow intermission on Spotify and Apple Podcast or subscribe to the Ken's YouTube channel. You can find all of the links at the ken.com slash I am. With that, back to your episode. Do you know how many UPI transactions were recorded in 2023? More than 100 billion? The month of December alone saw more than 12 billion transactions. Now, these numbers are testament to how UPI or the unified payments interface has revolutionized the way we use money. I mean, it's come to a point where we don't even think twice about creating financial

connections with strangers through UPI. There are more than 300 million users in India using UPI freely to carry out their financial transactions. But did you know that your bank can block your account without warning or any explanation based on your UPI transactions. And what's worse, you could even come under the radar of law enforcement authorities like the cybercrime police. Anyone who even unknowingly makes a transaction directly or indirectly with a fraudster

can be considered suspicious by authorities. Banks and law enforcement agencies, meanwhile, still have not managed to figure out a standard operating procedure in dealing with such matters. and this has led them to adopt a block first and ask questions later kind of an approach that has been making the lives of innocent victims of financial crimes even harder. Welcome to Daybreak, a business podcast from the Ken. I'm your host, Nick Da Sharma, and I don't chase the news cycle. Instead, thrice a week on Mondays, Wednesdays and Fridays,

I will come to you with one business story that is worth understanding and worth your time. Today is Monday, the 8th of January. A colleague has a medical emergency and asks to borrow some money from you. You make a UPI transfer of $15,000. Later, the said colleague returns the money to you again via UPI. And the next thing you know, you cannot make any transactions. The message you see keeps alternating between payment was declined due to a technical error or bank declined this payment.

You make frantic calls to your bank but to no avail. Finally, you pull out some connections and get in touch with a senior official at your bank, and they tell you, you, sir, are being investigated by the Gujarat Cyber Police. For what? The bank official has no answer. Sounds straight out of a crime show, right? Unfortunately, it happened for real to Arif, an operations executive at a Bangalore-based startup who spoke to the Ken's deputy editor, Arundati Ramanathan. He only wanted to reveal his first name.

And what's worst is that similar things are happening to many, many people across the country. Now, it is not farfetched to think of UPI as a kind of a social media platform. You can add people, you can even send messages. As of now, there are more than 300 million users on the platform. But do we exercise the same amount of caution on UPI as we do on our social media apps? I'll take the liberty to say no on behalf of most people. I don't. I honestly never thought of it like that.

So is R.F. to blame or others like him to blame? Not entirely, right? Digital payment is super convenient. Sometimes I don't even carry a wallet with me when I go out to buy groceries because all the vendors that I buy from accept UPI payments. And that means that UPI is rapidly replacing previously cash-only interactions like buying groceries or paying for a cab. But since these are small-ticket, high-frequency transactions,

UPI users like us regularly engage with strangers to make or receive payments. And like RIF, there are many people who are unfortunate enough to have made transactions with fraudsters on UPI. As you can tell, this nonchalant approach comes with serious consequences. These UPI users are being tagged as suspicious and are seeing their bank accounts get frozen. And if you think they can always call the banks and have it fixed, it is not that easy.

In fact, it is far from easy. Let me begin by telling you about some instances of the ordeal that folks have had to face because of UPI transactions. Anand is a Bangalore-based co-founder of Deep Stratt, a risk mitigation and cyber security advisory. And yes, I know what you're thinking. The I&E is not lost. For Anand, it was a sum of $125 that he received via phone pay into his SBI account that got his bank account blocked.

After trying to make a transaction a bunch of times, Anand called the phone pay customer care, where he learned that the bank was behind the decision to block his account. So Anand went to his bank, but his local branch manager gave an unclear reason, saying that it could have been because either a K-Y-C or no-your-c customer was not. done or because the account was flagged as suspicious. The bank manager did not have any other details to offer except that the bank had received a trigger to block his account. After several trips to the bank and another round of a full KYC, the freeze-on-Anand's account was finally lifted. While the blocked account was not a primary one for Anand, Arif was not that lucky. He had two of his bank accounts

frozen. One was with Axis Bank into which his colleague had transferred the money that had been flagged as suspicious, and the other was with Citibank, which is also his primary account, and it was also blocked after he transferred the 15,000 sum from Axis Bank to Citibank. After many calls and a lot of anxiety, he found out through his bank that he was being investigated by the Gujarat Cybersecurity Police. He tried everything, but his accounts remained frozen and he could not even pay his children's school fee on time. So why are innocent people like RIF getting trapped into this whole web of UPI fraud? Stay tuned to find out. Let's look at how banks decide to freeze an account in the first place. A risk officer at a bank actually explained it to us.

He said that there are a few scenarios in which it happens. It could be when a customer reports a fraud, it could also be when a bank identifies fraudulent activity on its own in a customer's account, then it could also happen if a customer cannot be reached by the bank in case of suspicious transactions in the account. And finally, when there is a law enforcement order or from any other statutory body. In such a case, orders can range from a debit freeze, which means that the account holder cannot draw money but can receive money. It could also be a lien mark where the amount under suspicion is held,

and then there could be a total freeze when no credit or debit can be made. Arundhati spoke to KVM Prasad, the deputy superintendent of police for Cybersecurity Bureau in Talingana. And he told us that most investigating officers ask for a debit freeze. Even a risk officer at a bank confirmed this to us. Banks can also execute a freeze when there is a cyber complaint made through a cybercrime monitoring portal about their customer being suspicious. Many have been caught in this crossfire between law enforcement agencies and bank's efforts to recover money which has been emptied out of cyber fraud victim's bank accounts. Numerous such cases were documented in Kerala this year alone.

Prasad told us that when money is stolen from a victim's account, it goes through multiple bank accounts before fraudsters finally withdraw it. So in chasing this trail, investigators in some cases need to examine bank accounts. accounts for five levels deeper than the fraudsters account. Also, it is important to remember that the police are also rushing to act on the complaint within the 24-hour golden hour time period. This is to help recover proceeds or at least analyze the nature of the money trail. A former compliance executive at a mid-sized bank told us that the pressure to act in this

window, along with banks being overly cautious, is also a reason why we are seeing a block first-ask-questions-later kind of approach. And we all know that in such an investigation, in general, beneficiaries of crime proceeds are under suspicion and they are the ones considered as fraudsters. Because of this, innocent people who either directly get crime proceeds from a fraudster or receive money from someone who was exposed to a fraudster are also treated as suspicious. In May, UPI saw 9 billion transactions. Even if a tiny percentage of these are linked to a fraudster, the number of those flagged as suspicious would run into thousands.

Now, you may want to ask, what is the government doing? In 2019, the Ministry of Home Affairs set up a national cybercrime reporting portal, along with a toll-free helpline number 1930 for immediate reporting of financial frauds. Remember the number just in case it's 1930. Since then, until 2022, more than 175,000 complaints were lodged. But only 10 to 15% of these complaints are solved on an average. Officials from banks, the NCPI or the National Payments Corporation of India, which is the body that runs UPI and the cyber police, say that even if the scale of innocent people getting caught in this fraudulent money trail is small, such cases come up as collateral damage.

Coming up next, but for those who are hit by this, what follows is a nerve-wracking experience and the road to recourse is full of obstacles. From facing the criminal liability of checks bouncing to risking default on loan payments, the real-world implications of not being able to operate a bank account makes this a significant setback for those who are affected. In the cases that the ken looked at, what was also seen was a lack of communication and uniform standard operating procedure among banks involved in these cases. This means that the onus of proving innocence lies with those whose accounts were blocked.

Plus, it changes the way we look at payment safety. It is not just a transaction-related risk anymore. Now, it is an identity-related risk. Meaning, we should probably start looking at it. it as a you are who you transact with kind of a situation. To know more about this, don't forget to read Arundati's eye-opening report that I have linked to the show notes of this episode. Daybreak is produced from the Newsroom of the Ken, India's first subscriber-focused business

news platform. What you're listening to is just a small sample of our subscriber-only offerings. A full subscription unlocks daily long-form feature stories, newsletters, subscriber-only apps, and podcast extras. Head to the ken.com and click on the red subscribe button on the top of the website. I am Snigda Sharma, your host, and today's episode was edited by my colleague Rajiv Sien.