In February, Alok (name changed), a business analyst based in the western Indian city of Pune, got a text message asking him to pay 1,000 rupees ($10.75; £7.9) as a speeding fine.

The message asked him to settle the amount quickly to avoid his driving licence being suspended, prompting Alok to immediately click on the link to pay. He was asked to share an OTP (one-time password) to complete the payment.

Minutes later, his credit card was charged $3,225, the maximum transaction limit.

Alok had inadvertently authorised a much larger sum than what was supposed to be the fine, falling prey to a common scam in India where fraudsters send fake messages mimicking official websites that direct unsuspecting individuals to phishing links and drain their bank accounts.

Experts call this a type of fraud "social engineering" - where scammers dupe their victims using psychological manipulation, instilling fear and urgency.

India has seen an alarming rise in such fraud with the unprecedented adoption of digital payments in the country over the last half decade.

Nearly 2.5 million people have lost some $2.5bn in 2025, a staggering 4,300% rise since 2021. The explosive jump in cases has finally prompted India's central bank, the Reserve Bank of India (RBI) to step in.

In a discussion paper released earlier this month, the central bank said it was mulling several measures to tackle the problem.

These include a one-hour lag at the payer's end in account-to-account transactions and additional authentication by a "trusted person" for high-value digital payments by vulnerable sections of society such as elderly people.

The paper also talks about limits and reviews of large credits to customer accounts to ensure these aren't mules (accounts used for illegal transfer of money), and giving people more control to switch on/switch off digital payments and set limits like they can for cards.

India's central bank is mulling several measures to reduce cyber fraud, including a potential time lag in payments

Several experts the BBC spoke to say that while the RBI's proactive stance is a welcome step, these proposals - which will be finalised after public comments and feedback - could end up having only a limited impact.

The first proposal, for instance, to have lagged payments could be effectual in preventing OTP fraud of the type that Alok fell for, but in value terms such scams are a "minuscule proportion of the overall fraud landscape", Rajesh Bansal, former CEO of the RBI's Innovation Hub, told the BBC.

"These scams were the dominant variety three or four years ago, but frauds have now moved to another level, and are far more sophisticated."

Implementation of these measures could also be challenging, according to experts.

"It is not going to be easy to implement a lag because there are so many parties involved in the payment network. There is no simple way to do it without changing the current architecture," says Wriju Ray of IDfy, a leading regulatory technology company.

The RBI acknowledges this in the discussion paper, saying introducing lags would require changes across the system, from transaction queuing to cancellation mechanisms, and would involve "cost and effort for the ecosystem".

Moreover, the central bank acknowledges, it would "conflict with the core design principle of immediacy of digital payments".

"It's like building an expressway and adding speed breakers every few kilometres," says Bansal.

And this friction is unlikely to help much.

"They [scammers] are just going to figure out a way to overcome the lag. For instance, they might ask for a customer to undertake a payment and wait for an hour for their acknowledgement so an alarm is not raised," says Ray.

According to him, some of the other measures being considered are fair but raise several questions.

"Additional checks for senior citizens is probably highly recommended but how does one comply? What if your so-called 'trusted adviser' is abroad? And what if they ask you to go ahead with a transaction that still ends up being a fraudulent one? Then who does the accountability move to?" asks Ray.

The proposal to further strengthen the detection of mule accounts by limiting credits and enhancing due diligence , could also be effective, but will be resource-intensive and costly. And ultimately, those costs will have to be passed down to consumers, says Ray.

According to Bansal, the RBI already has a ready mule detection platform called Mulehunter.AI which provides information on beneficiary accounts.

"It was conceptualised when I was the CEO. It needs to be implemented in near real-time in the banking system. Unfortunately, that has not happened," he says, calling for its expeditious execution.

But more regulation is only part of the solution, say experts.

Doubling down on education, along with some of these measures, will be critical.

India's population has been going digital at a rate that's much faster than safeguards or literacy have been able to keep pace.

The central bank has been driving educational initiatives, roping in superstars like Amitabh Bachchan and using high-viewership IPL cricket games to push through their campaigns - but more investment is needed in improving digital literacy, according to Ray.

The RBI must also collaborate more closely with other agencies such as the police, ministries, the market regulator and others to tackle the problem at its core, says Bansal.

"The challenge right now is, whose baby is this?"

However, the fact that the regulator has taken renewed cognisance of the growing problem through a consultative process is a welcome step, says Ray.

"These discussions will eventually result in regulation. This is a big change from earlier where the RBI would just announce a diktat." (BBC)

Update news