What is the Proposed Change?
In response to a rise in digital payment fraud, leading Indian banks have proposed a new safety feature to the Reserve Bank of India (RBI) and the National Payments Corporation of India (NPCI). The core idea is to introduce a 'Yes/No' confirmation prompt
for certain UPI transactions that are flagged as high-risk or suspicious by a bank's fraud detection system. Under this proposal, before a suspicious payment is completed, the user would receive a pop-up asking for a final confirmation. If the user selects 'Yes', the transaction proceeds instantly. If they select 'No', it is cancelled. This extra step is designed to give users a final moment to review a payment before their money is gone, specifically targeting online merchant and peer-to-peer (P2P) transfers that seem out of the ordinary.
Why is This Being Considered?
The incredible growth of UPI has been a success story, but it has also attracted a surge in cyber fraud. Scammers are using increasingly sophisticated methods like phishing, SIM-swap scams, and social engineering to trick people into authorising payments. Many victims are tricked into approving what they believe are legitimate requests, only to realize they've sent money to a fraudster. Because UPI transactions are instant and generally irreversible, recovering the funds is extremely difficult. This proposal for a second confirmation is a direct response to this problem, aiming to curb what is known as 'authorised push payment fraud', where the legitimate user is manipulated into sending money themselves. The extra checkpoint serves as a crucial pause, giving users a chance to identify a scam before it’s too late.
What Counts as 'Unusual Behaviour'?
The confirmation prompt won't appear for every transaction. Banks have specifically argued against a blanket rule for all high-value payments, as it would create unnecessary friction and slow down the system. Instead, the feature will be triggered by risk-based authentication, where AI and machine learning systems identify transactions that deviate from a user's normal behaviour. While the exact rules are still being finalised, examples of 'unusual behaviour' could include: a transaction made at an odd hour (like 2 a.m.), a payment to a beneficiary you've never paid before, transfers to newly created bank accounts, or transactions initiated from a different geographical location than usual. Banks already use these types of systems to monitor for fraud across credit cards and net banking, and the same logic would be applied to UPI payments.
Balancing Security and Convenience
The central challenge for UPI has always been to balance robust security with a seamless user experience. The platform's success is built on its speed and simplicity. The proposed 'friction-based' model aims to maintain this balance by applying extra checks only when necessary. Banks have pushed for this targeted approach to avoid slowing down the vast majority of legitimate, low-risk transactions. This move is part of a broader push by the RBI to strengthen the digital payment ecosystem. As of April 2026, two-factor authentication (2FA) became mandatory for all digital payments, requiring a combination of factors like a PIN, a registered device, or biometrics. While many UPI apps already met this standard through device binding and a PIN, the new confirmation prompt for suspicious transactions adds another intelligent layer of security on top of this foundation.
What This Means for You
As of early August 2026, this additional confirmation is still a proposal under discussion between banks, the NPCI, and the RBI. It has not been implemented, and there is no official launch date. If it is approved, most of your daily UPI payments will likely remain unchanged. You would only encounter the extra 'Yes/No' pop-up when your bank's system flags a transaction as potentially risky based on its specific parameters. This measure is not designed to inconvenience users but to provide a critical safeguard against fraud. It is one of several security enhancements, including stricter rules around API usage and transaction limits, introduced to make the UPI ecosystem safer and more resilient as it continues to grow.
