Cybersecurity Risks in UPI Transactions: Legal Issues and Regulatory Responses

Abstract

The Unified Payments Interface (UPI) has reshaped retail payments in India, processing over eighteen billion transactions every month and contributing to more than four-fifths of the country's digital payment volume. This rapid adoption, however, has been accompanied by a parallel rise in cyber-enabled financial fraud, ranging from phishing and SIM-swap attacks to fake QR codes and social engineering scams. This paper examines the cybersecurity risks associated with UPI transactions and the legal and regulatory framework that has developed in response, including the Information Technology Act 2000, the Reserve Bank of India's customer liability circular of 2017, the Digital Personal Data Protection Act 2023, and the Integrated Ombudsman Scheme. Using a doctrinal and analytical method supported by secondary data drawn from RBI annual reports, Parliament responses, NCRB trends and recent judicial decisions, the paper finds that while the zero-liability framework offers strong protection on paper, weak enforcement, low awareness, and slow grievance redressal continue to leave a large share of victims uncompensated. The paper concludes with recommendations for strengthening real-time fraud detection, harmonizing banking and criminal law remedies, and improving victim-centric reporting mechanisms.