AI UPI Fraud Detection India: How Banks Are Using Machine Learning to Fight a ₹4,245 Crore Crisis

India’s UPI story is one of the most remarkable technology achievements in human history. From near-zero in 2016 to 185.8 billion transactions in FY 2024–25 — 83% of all digital payment volume in the country — UPI has genuinely transformed how a billion people move money. But every revolution leaves a door open, and India’s UPI revolution left a very large one: fraud.

This article cuts through the noise to give you the verified facts: the scale of the problem, exactly which AI tools are being deployed by RBI, NPCI, SBI, HDFC, ICICI, Razorpay, and PhonePe, how the technology actually works, and what India’s new regulatory framework means for the developers and fintech founders building on this ecosystem.

Sources: Ministry of Finance (Lok Sabha, Nov 2024), RBI Annual Report FY2024–25, Business Standard (June 2025).

The Scale of India’s UPI Fraud Problem — in Verified Numbers

Before we talk about solutions, let us understand the actual scale — not the inflated figures that circulate on social media, but the numbers tabled in Parliament and published by the RBI.

According to data presented by the Ministry of Finance in the Lok Sabha in November 2024, UPI fraud cases rose 85% in FY 2023–24 compared to FY 2022–23. In FY24 alone, India recorded 13.42 lakh UPI fraud incidents with losses of ₹1,087 crore — the highest since UPI became mainstream. By September 2024, FY25 had already recorded 6.32 lakh cases amounting to ₹485 crore, on track to exceed the previous year.

The broader banking picture is even more stark. The RBI’s December 2024 report showed that bank fraud cases in April–September 2024 jumped to 18,461 incidents, with the total amount rising eightfold to ₹21,367 crore — compared to ₹2,623 crore in the same period a year earlier.

And here is what makes this a technology problem, not just a social awareness problem: only about 6% of fraud chargebacks are successfully recovered. Once money moves through a mule account network, it is gone. Rule-based systems — the kind that say “block transactions over ₹50,000 at 2 AM” — cannot keep up with fraudsters who have already learned those rules. That is exactly why AI is being deployed.

How AI UPI Fraud Detection Actually Works

To understand what banks and NPCI are building, you first need to understand why the old system fails.

Traditional fraud detection relies on static rule-based models: a fixed list of conditions that flag a transaction. These systems are fast but brittle. They generate enormous false positives (blocking legitimate transactions), and they cannot adapt when fraudsters deliberately design their behaviour to stay below the threshold.

AI-based fraud detection works differently. Machine learning models — particularly gradient boosting, deep neural networks, LSTMs (Long Short-Term Memory networks), and graph-based models — analyse hundreds of signals simultaneously:

• Behavioural signals: Is this transaction consistent with the user’s historical patterns? Different time, amount, device, or location than usual?
• Device signals: Is this a known device? Has the device been linked to other fraud cases?
• Network signals: Is the recipient account connected to other flagged accounts via a graph of transactions?
• Velocity signals: How many transactions has this account done in the last 60 seconds, 5 minutes, 24 hours?
• Social engineering signals: Were there incoming calls or messages before the transaction — a pattern consistent with vishing (voice phishing) scams?

All of this is scored in under 200 milliseconds — fast enough to intervene before a UPI payment clears. A high-risk score triggers a step-up authentication, a delay, or a full block. A low-risk score lets the transaction sail through without friction.

This is not theoretical. NPCI processes over 500 million UPI transactions daily. Running an AI risk score on every single one, in real time, is one of the most demanding engineering challenges in Indian technology.

RBI’s MuleHunter.AI — India’s First National AI Fraud Tool

In December 2024, RBI Governor Shaktikanta Das announced MuleHunter.AI — an AI/ML-based model developed by the Reserve Bank Innovation Hub (RBIH) in Bengaluru, designed specifically to detect mule accounts.

A mule account is a bank account used by criminals to receive and launder stolen funds. They are central to nearly every large-scale UPI fraud: money stolen from one victim is immediately moved through a chain of mule accounts to obscure its origin. By the time the victim reports the fraud, the trail is cold.

MuleHunter.AI works by analysing 19 distinct patterns of mule account behaviour — patterns identified by RBIH in collaboration with banks. Unlike rule-based systems that generate high false positives, the ML model learns from the data and adapts as criminal behaviour evolves.

The early results are significant:

• First piloted successfully in two public sector banks.
• By November 2025, RBI Governor Sanjay Malhotra confirmed nearly 20 banks had adopted the system.
• By December 2025, an RTI response confirmed 23 banks have implemented MuleHunter.AI.
• RBI has encouraged all banks to collaborate with RBIH to expand the initiative further.

NPCI’s Federated AI Framework — Fraud Detection Without Sharing Your Data

While MuleHunter.AI operates at the RBI level, the National Payments Corporation of India (NPCI) — the body that runs UPI — is working on a different and more technically ambitious approach: federated learning.

In a traditional AI system, all the data from all banks would need to be pooled in one place to train a shared model. That creates massive privacy and competitive concerns — banks do not want to share their customer transaction data with each other.

Federated learning solves this elegantly. Each bank trains a local AI model on its own data. Only the model updates (not the raw data) are shared with a central coordinator. The central model gets smarter from the collective intelligence of every bank in the network, without any individual bank’s customer data ever leaving its servers.

NPCI’s federated AI pilot combines each bank’s internal risk scores with NPCI’s network-wide transaction data to produce a real-time fraud risk score for every UPI transaction. The system is being piloted with leading banks and represents a significant step toward a unified national fraud detection layer.

In parallel, the government’s Digital Intelligence Platform (DIP) — operated by the Telecom department and supported by RBI and NPCI — has onboarded more than 1,000 banks, TPAPs (third-party app providers), and payment system operators. It provides a Financial Fraud Risk Indicator (FRI) that assigns a risk score to mobile numbers involved in a transaction, drawing on telecom, bank, and police data simultaneously.

What India’s Major Banks Are Building

SBI — AI at Scale for 500 Million Accounts

State Bank of India — the country’s largest bank with over 500 million customers — uses AI-based fraud detection as part of its core operations. SBI has developed AI solutions through its Code For Bank hackathon programme, and its systems monitor UPI transactions in real time using anomaly detection models. The bank’s AI infrastructure also supports credit risk assessment, reducing dependence on purely historical credit data — a significant improvement for the hundreds of millions of Indians with thin credit files.

HDFC Bank — Deep Learning on Every Transaction

HDFC Bank has implemented real-time deep learning models that assign a fraud risk score to every single transaction before it processes. Industry analysis has reported that HDFC’s AI-based fraud detection has contributed to a 30% decrease in fraudulent activities, saving the bank significant losses annually. HDFC Bank is also a named partner in the NPCI federated learning pilots, contributing its transaction data to the shared model without exposing raw customer records.

ICICI Bank — ML Across Private Banking and Compliance

ICICI Bank uses machine learning in its private banking services for both fraud detection and regulatory compliance. The bank’s systems analyse behavioural patterns, flagging anomalies that rule-based engines would miss. ICICI has been recognised in multiple industry analyses — including FutureSkills Prime’s analysis — as one of the frontrunners in ML-based fraud prevention among Indian private banks.

Razorpay — Device Fingerprinting and Agentic Payments

Razorpay, India’s largest payment gateway by merchant count, has been building a layered fraud prevention system that combines device fingerprinting, behavioural biometrics, and AI risk scoring. The company published a detailed 2026 guide on device fingerprinting for Indian payments — making the distinction between device verification (is this device trusted?) and biometric verification (is this person the account holder?) — a distinction critical for building effective fraud stacks. Razorpay is also one of the first Indian fintechs to pilot agentic AI payments via UPI with NPCI, integrating conversational AI with real-time payment rails.

PhonePe — ChatGPT Integration for Fraud Prevention

PhonePe, which handles over 48% of all UPI transaction volume in India, is embedding generative AI into its platform — including an integration with ChatGPT — to enhance transaction processing and customer engagement. The company’s fraud detection stack analyses device signals, transaction velocity, and account-level behavioural patterns across hundreds of millions of transactions daily.

The RBI’s FREE-AI Framework — India’s Regulatory Blueprint for AI in Finance

On August 13, 2025, the RBI released one of the most important documents in Indian fintech history: the FREE-AI Framework — Framework for Responsible and Ethical Enablement of Artificial Intelligence in the Financial Sector.

Chaired by Professor Pushpak Bhattacharya of IIT Bombay, the committee produced a comprehensive roadmap with 26 recommendations structured across six pillars:

1. Infrastructure: Building indigenous, sector-specific AI models to reduce dependence on global LLMs.
2. Policy: Aligning AI governance with existing RBI regulations.
3. Capacity Building: Training banking sector professionals in AI literacy.
4. Governance: Establishing accountability frameworks for AI decision-making.
5. Consumer Protection: Ensuring AI systems are explainable and do not discriminate.
6. Independent Assurance: Third-party audits of AI models used in critical financial decisions.

Critically, the FREE-AI framework mandates that AI used in fraud detection must be explainable — banks cannot just say “the model flagged it.” They must be able to explain why a transaction was blocked or a loan was denied, both to the customer and to the regulator. This is a major shift from the black-box models that currently power much of India’s fintech infrastructure.

The framework also calls for integration of AI tools with UPI and other digital public platforms and the formation of a multi-stakeholder committee under the RBI to monitor AI evolution and emerging risks in real time.

How AI Fraud Detection Has Improved: A Quick Comparison

Factor	Rule-Based (Old)	AI/ML-Based (Current)
Detection accuracy	~70–75%	Up to 99.1%
False positive rate	High (blocks legitimate transactions)	Reduced by up to 80%
Adaptation speed	Weeks (manual rule updates)	Continuous (model retraining)
Mule account detection	Poor (static thresholds)	Strong (19 behavioural patterns)
Cross-bank intelligence	None	Via federated learning (NPCI)
Explainability	Easy (if X then Y)	Improving (FREE-AI mandate)

Detection accuracy and false positive reduction figures sourced from Decentro industry analysis (November 2025) and RBIH MuleHunter.AI deployment data.

What Is Still Missing — The Gaps That Remain

For all the progress, the picture is not complete. Several critical gaps remain:

• Recovery rates are dismal. Only about 6% of fraud chargebacks are successfully recovered. AI is good at prevention but once money is gone through a mule chain, retrieval is near-impossible without law enforcement coordination.
• Small banks are behind. The 23 banks that have adopted MuleHunter.AI represent the larger institutions. India has hundreds of cooperative banks and small finance banks that still run on static rule systems.
• Social engineering remains AI’s biggest blind spot. No algorithm can detect a frightened victim who genuinely believes she is transferring money to save a family member — vishing calls, fake KYC requests, and AI-generated voice clones impersonating bank officials are now the dominant attack vector. India has already seen deepfake technology used to forge Aadhaar documents for fraudulent transactions, as reported in our Ahmedabad Aadhaar deepfake fraud arrest — a gap neither MuleHunter.AI nor federated learning can fully close, yet.
• Real-time coordination between telecom, banking, and police is limited. The Digital Intelligence Platform is a step forward, but the integration is still partial. A fraudster who switches SIM cards can evade detection longer than they should.

What This Means for Indian Developers and Fintech Founders

If you are building on India’s payment stack, the broader wave of AI in Indian fintech is creating both compliance obligations and product opportunities that go well beyond fraud detection.

The RBI FREE-AI framework will likely become mandatory guidance for any fintech handling payments. If you are using a third-party AI model for fraud scoring or credit decisions, you now need to think about explainability, bias testing, and audit trails — not just accuracy.

The NPCI federated learning architecture is a platform play. Banks and payment operators that join the network improve the shared model for everyone — and get a better fraud score in return. For startups building fraud detection as a service, this is a reference architecture worth studying.

And the RBI’s Digital Payments Intelligence Platform, once fully rolled out, will be a layer below every UPI transaction — a national AI-powered fraud shield. Understanding how it works, what signals it uses, and how to design UX around its interventions (friction for risky transactions, zero friction for safe ones) will separate good fintech products from great ones.

FAQs