The Dark Side of India’s Fintech Revolution: UPI Frauds and Digital Extortion

Abstract

India’s fintech revolution, anchored by the Unified Payments Interface (UPI), has transformed financial transactions by making them fast, seamless, and widely accessible. Yet, with this rapid digitization comes a darker reality: an exponential rise in cyber fraud. From phishing scams exploiting unsuspecting users to organized rackets orchestrating “digital arrests”, cybercriminals are weaponizing technology against vulnerable citizens. This article critically examines the anatomy of these frauds, the legal framework governing them, the challenges in enforcement, and potential pathways toward building a safer digital ecosystem.

Introduction: Fintech Boom, Fraud Bloom

India today leads the world in digital payments, with UPI alone recording more than 14 billion transactions per month in 2025. This unprecedented adoption has made India the envy of global economies, but it has also painted a giant target for cybercriminals.

The National Crime Records Bureau (NCRB) has reported a consistent rise in cyber fraud complaints, with financial frauds forming the majority. Particularly alarming are cases of UPI-linked scams and the recent phenomenon of digital arrest rackets, where fraudsters impersonate law enforcement agencies and extort money from victims.

These crimes are not isolated incidents but part of an evolving pattern of digital exploitation that challenges the existing legal order.

Anatomy of a Digital Deception: How UPI and “Digital Arrests” Work

The methods employed by cybercriminals reveal both sophistication and psychological manipulation.

UPI Frauds

UPI frauds typically involve phishing links, fake apps, QR code scams, or remote access tools. Victims are tricked into authorizing payments themselves, which makes recovery difficult under banking norms. For example, scanning a QR code does not credit money into a user’s account but instead debits it – a fact most users remain unaware of.

Digital Arrest Scams

Digital Arrest Scams have emerged as a chilling evolution of fraud. Call centers, often operating transnationally, pose as police officers, CBI agents, or cyber crime officials. Victims are coerced into video calls, threatened with fabricated criminal charges, and then “digitally arrested” until they transfer large sums of money.

The scams combine technological deceit with fear-based coercion, creating a new category of cybercrime that falls into a grey area of existing laws.

Legal Landscape: What the Law Says and What It Doesn’t

India’s legal framework provides mechanisms to deal with cyber fraud, but its adequacy in addressing modern crimes is questionable.

• The Information Technology Act, 2000 (IT Act) remains the primary legislation. Section 66C criminalizes identity theft, while Section 66D penalizes cheating by personation using computer resources.
• The Indian Penal Code, 1860 provides punishment under Section 419 and 420 for impersonation and cheating.
• The Reserve Bank of India (RBI) has issued circulars ensuring that victims of unauthorized electronic transactions are not held liable if the fraud occurs without their negligence.

However, these provisions fail to directly address “Digital Arrests” scams, which combine impersonation, extortion, and psychological harassment. The hybrid nature of such crimes demands a more advanced legislative response—one that reorganizes the fusion of traditional fraud with digital coercion.

Enforcement Realities: Why the System Struggles

Despite the legal framework, enforcement remains a daunting challenge.

• Jurisdiction Hurdles plague cybercrime cases, as many fraudsters operate across borders, making investigation and prosecution cumbersome.
• Lack of Technical Expertise and Manpower in police forces further weakens responses. Cybercrime units in many states remain understaffed, and the conviction rate in cybercrime cases is abysmally low.
• Digital Literacy Gap: A significant portion of India’s population, especially in rural and semi-urban areas, lacks the awareness necessary to distinguish genuine communication from fraud. Criminals exploit this gap mercilessly, relying on fear and ignorance to trap victims.

Courtrooms and Regulator Responses: A System Waking Up

Judicial and regulatory interventions have begun to recognize the gravity of these crimes.

• Courts have emphasized the duty of banks and digital service providers to ensure user protection. For instance, the Delhi High Court in SBI v. RBI (2021) underscored the importance of robust grievance redressal mechanisms in digital fraud cases.
• The RBI has introduced measures such as mandatory SMS alerts, dispute resolution mechanisms, and zero-liability rules for victims.
• The Indian Computer Emergency Response Team (CERT) issues advisories about phishing and fake apps.

While these steps show intent, their implementation often lags behind the speed of evolving scams.

Beyond Borders: Lessons from Global Practices

Cyber fraud is not unique to India. Examining other jurisdictions offers valuable insights:

• The United States Federal Trade Commission (FTC) runs a dedicated scam reporting and victim support portal, enabling early detection and crackdown on fraud patterns.
• The United Kingdom’s Action Fraud system consolidates citizen complaints into a central database, making it easier for police to investigate.
• China has cracked down on telecom fraud syndicates, dismantling international rackets with military-like precision.

India could benefit from adopting a centralized reporting and tracking system for cyber frauds, coupled with cross-border cooperation treaties to address the transnational nature of these crimes.

The Way Forward: Building Digital Trust in the Age of Fraud

A multipronged strategy is essential to safeguard citizens and preserve trust in India’s digital economy:

1. Law Reform: Update existing provisions to specifically criminalize coercive scams such as digital arrests.
2. Capacity Building: Train and equip police with advanced tools to track and prosecute cybercriminals.
3. Consumer Awareness Campaigns: Move beyond urban centers and penetrate into rural India, empowering citizens to identify and resist fraud.
4. Technological Innovations: Banks and fintech platforms can deploy AI-driven fraud detection systems capable of flagging suspicious patterns in real time.
5. Victim Compensation Mechanism: Mitigate the devastating financial impact on citizens.

Ultimately, the fight against cyber fraud is not just a legal battle but a social one—requiring awareness, resilience, and systematic accountability.

Conclusion

The rise of UPI frauds and digital arrest rackets highlights the paradox of India’s digital journey: the very system designed to democratize finance is being weaponized against its users. While the IT Act, IPC, and RBI guidelines provide a partial shield, gaps in legislation and enforcement leave citizens vulnerable.

To preserve trust in digital platforms, India must urgently strengthen its laws, build institutional capacity, and promote digital literacy. In a country where fintech is the backbone of economic inclusion, protecting citizens from digital fraud is not optional—it is indispensable.

References

• Information Technology Act, No. 21 of 2000, Sec. 66D (India).
• Indian Penal Code, No. 45 of 1860, Sec. 419, 420.
• Reserve Bank of India, Circulars on Customer Protection – Limiting Liability of Customers in Unauthorized Electronic Banking Transactions (July 6, 2017).
• State Bank of India v. Reserve Bank of India, W.P.(C) 1161/2021, Delhi High Court (India).
• National Crime Records Bureau, Crime in India 2022: Statistics (Ministry of Home Affairs, Govt. of India).
• Federal Trade Commission, Scam Reporting Portal (U.S.), available at https://reportfraud.ftc.gov.
• UK Action Fraud, National Fraud and Cyber Crime Reporting Centre, available at https://www.actionfraud.police.uk.
• CERT-In, Advisories on Phishing and Malware Attacks (Govt. of India, 2024).

Also Read:
Rights of undertrial prisoners in India
How To Send A Legal Notice In India