Daybreak - On UPI, you are who you transact with

Episode Date: August 3, 2023

UPI or the Unified Payments Interface has revolutionised the way we use money. So much so that we don't think twice about freely accept financial connections with strangers. Since its launch seven years ago, 300 million users in India are on the UPI platform freely carrying out financial transactions.But did you know that your bank can block your account without a warning or any explanation? And what's worst, you could even come under the radar of law enforcement authorities like the cyber crime police. Anyone who unknowingly makes a transaction, directly or indirectly, with a fraudster can be considered suspicious by authorities.Meanwhile, banks and law enforcement agencies are yet to figure out a standard operating procedure in dealing with such matters. This had led them to adopt a ‘block first, ask questions later’ approach that's been making the lives of innocent victims even harder.Tune in to find out more.RecommendationOn the UPI social network, who do you ‘know’? And who do ‘they know’?Daybreak is produced from the newsroom of The Ken, India’s first subscriber-only business news platform. Subscribe for more exclusive, deeply-reported, and analytical business stories.

Hi, this is Rohan Dharma Kumar. If you've heard any of the Ken's podcasts, you've probably heard me, my interruptions, my analogies, and my contrarian takes on most topics. And you might rightly be wondering why am I interrupting this episode too. It's for a special announcement. For the last few months, I and Sita Raman Ganeshan, my colleague and the Ken's deputy editor, have been working on an ambitious new podcast. It's called Intermission.

We want to tell the secret sauce stories of India's greatest companies. Stories of how they were born, how they fought to survive, how they build their organizations and culture, how they manage to innovate and thrive over decades, and most importantly, how they're poised today. To do that, Sita and I have been reading books, poring over reports, going through financial statements, digging up archives, and talking to dozens of people. And if that wasn't enough, we also decided to throw in video into the mix. Yes, you heard that right. Intermission has also had to find its footing in the world of multi-camera shoots in professional studios, laborious editing, and extensive post-production. Sita and I are still reeling from the intensity of our first studio recording.

Intermission launches on March 23rd. To get alert, as soon as we release our first video. episode, please follow intermission on Spotify and Apple Podcast or subscribe to the Ken's YouTube channel. You can find all of the links at the ken.com slash I am. With that, back to your episode. Imagine a colleague has a medical emergency and asks to borrow some money from you. You make a UPI transfer of 15,000 rupees. Later, the said colleague returns the money to you again via UPI.

and the next thing you know, you cannot make any transactions. The message you see keeps alternating between payment was declined due to a technical error or bank declined this payment. You make frantic calls to your bank but to no avail. Finally, you pull out some connections and get in touch with a senior official at your bank, and they tell you, you, sir, are being investigated by the Gujarat cyber police. For what? The bank official has no answer. Sounds straight out of a crime show, right?

Unfortunately, it happened for real to Arif, an operations executive at a Bangalore-based startup who spoke to the Ken's deputy editor Arundati Ramanathan. He only wanted to reveal his first name. And what's worst is that similar things are happening to many, many people across the country. Now, it is not far-fetched to think of UPI as a kind of a social media platform. You can add people, you can even send messages. As of now, there are more than 300 million users on the platform. But do we exercise the same amount of caution on UPI as we do on our social media apps?

I'll take the liberty to say no on behalf of most people. I don't. I honestly never thought of it like that. So is R.F. to blame or others like him to blame? Not entirely, right? Digital payment is super convenient. Sometimes I don't even carry a wallet. with me when I go out to buy groceries because all the vendors that I buy from accept

UPI payments. And that means that UPI is rapidly replacing previously cash-only interactions like buying groceries or paying for a cab. But since these are small-ticket, high-frequency transactions, UPI users like us regularly engage with strangers to make or receive payments. And like RIF, there are many people who were unfortunate enough to have made transactions with fraudsters on UPI. As you can tell, this nonchalant approach comes with serious consequences. These UPI users are being tagged as suspicious and are seeing their bank accounts get frozen. And if you think they can always call the banks and have it fixed, it is not that easy.

In fact, it is far from easy. Welcome to Daybreak, a business podcast from the Ken. I'm your host, Nickda Sharma, and I Don't Chase the News Cycle. Instead, thrice a week on Mondays, Wednesdays, and I'm. On Fridays, I will come to you with one business story that is worth understanding and worth your time. Today is Friday, the 4th of August. Let me begin by telling you about some instances of the ordeal that folks have had to face because of UPI transactions. Arndh is a Bangalore-based co-founder of Deep Strat, a risk mitigation and cyber security advisory.

And yes, I know what you're thinking. The I&E is not lost. For Anand, it was a sum of 100. 25 rupees that he received via phone pay into his SBI account that got his bank account blocked. After trying to make a transaction a bunch of times, Anand called the phone pay customer care, where he learned that the bank was behind the decision to block his account. So Anand went to his bank, but his local branch manager gave an unclear reason, saying that it could have been because either a K-Y-C or no-your-c customer was not done

or because the account was flagged as suspicious. The bank manager did not have any other details to offer except that the bank had received a trigger to block his account. After several trips to the bank and another round of a full KYC, the freeze-on-Anand's account was finally lifted. While the blocked account was not a primary one for Anand, Arif was not that lucky. He had two of his bank accounts frozen.

One was with Axis Bank into which his colleague had transferred the money that had been flagged as suspicious and the other was with Citibank, which is also his primary account and it was also blocked after he transferred the 15,000 sum from Axis Bank to Citibank. After many calls and a lot of anxiety, he found out through his bank that he was being investigated by the Gujarat Cybersecurity Police. He tried everything but his accounts remained frozen and he could not even pay his children's school fee on time. So why are innocent people like R.F. getting trapped into this whole web of UPI fraud? Stay tuned to find out. Let's look at how banks decide to freeze an account

in the first place. A risk officer at a bank actually explained it to us. He said that there are a few scenarios in which it happens. It could be when a customer reports a fraud, it could also be when a bank identifies fraudulent activity on its own in a customer's account, then it could also happen if a customer cannot be reached by the bank in case of suspicious transactions in the account. And finally, when there is a law enforcement order or from any other statutory body. In such a case, orders can range from a debit freeze, which means that the account holder cannot draw money but can receive money. It could also be a lien mark where the amount under suspicion is held, and then there could be a total freeze when no credit or debit can be made.

Arundhati spoke to KVM Prasad, the Deputy Superintendent of Police for Cyber Security Bureau in Talingana, and he told us that most investigating officers ask for a debit freeze. Even a risk officer at a bank confirmed this to us. Banks can also execute a freeze when there is a cyber complaint made through a cybercrime monitoring portal about their customer being suspicious. Many have been caught in this crossfire between law enforcement agencies and bank's efforts to recover money which has been emptied out of cyber fraud victims' bank accounts. Numerous such cases were documented in Kerala this year alone.

Prasad told us that when money is stolen from a victim's account, it goes through multiple bank accounts before fraudsters finally withdrawed. So in chasing this trail, investigators in some cases need to examine bank accounts for five levels deeper than the fraudsters account. Also, it is important to remember that the police are also rushing to act on the complaint within the 24-hour golden hour time period. This is to help recover proceeds or at least analyze the nature of the money trail. A former compliance executive at a mid-sized bank told us that the pressure to act in this window, along with banks being overly cautious, is also a reason why we're seeing a block first-ask-questions-later kind of approach. And we all know that in such an investigation,

in general, beneficiaries of crime proceeds are under suspicion and they are the ones considered as fraudsters. Because of this, innocent people who either directly get crime proceeds from a fraudster or receive money from someone who was exposed to a fraudster are also treated as suspicious. In May, UPI saw 9 billion transactions. Even if a tiny percentage of these are linked to a fraudster, the number of those flagged as suspicious would run into thousands. Now, you may want to ask, what is the government doing? In 2019, the Ministry of Home Affairs set up a national cybercrime reporting portal, along with a toll-free helpline number 1930 for immediate reporting of financial frauds. Remember the number just in case it's 1930. Since then, until 2022,

more than 175,000 complaints were lodged. But only 10 to 15% of these complaints are solved on an average. Officials from banks, the NCPI or the National Payments Corporation of India, which is the body that runs UPI and the cyber police, say that even if the scale of innocent people getting caught in this fraudulent money trail is small, such cases come up as collateral damage. Coming up next, but for those who are hit by this, what follows is a nerve-wracking experience and the road to recourse is full of obstacles. From facing the criminal liability of checks bouncing to risking default on loan payments, the real-world implications of not being able to operate a bank account makes this a significant setback for those who are affected.

In the cases that the Ken looked at, what was also seen was a lack of communication and uniform standard operating procedure among banks involved in these cases. This means that the onus of proving innocence lies with those whose accounts were blocked. Plus, it changes the way we look at payment safety. It is not just a transaction-related risk anymore. Now, it is an identity-related risk. Meaning, we should probably start looking at it as a you are who you transact with kind of a situation. To know more about this, don't forget to read Arundati's eye-opening report that I have linked to the show notes of this episode.

Daybreak is produced from the Newsroom of the Ken, India's first subscriber-focused business news platform. What you're listening to is just a small sample of our subscriber-only offerings. A full subscription unlocks daily long-form feature stories, newsletters. subtitles, subscriber-only apps and podcast extras. Head to the ken.com and click on the red subscribe button on the top of the website. I am Snigda Sharma, your host, and today's episode was edited by my colleague Rajiv Sien.