RBI proposes 1-hour hold on UPI payments over 10,000, kill switch to curb cyber frauds

The Reserve Bank of India (RBI) has released a landmark discussion paper titled "Exploring safeguards in digital payments to curb frauds," proposing a series of friction-based security measures to combat the skyrocketing rise in online financial crimes. The centerpiece of the proposal is a mandatory one-hour delay for individual account-to-account transfers exceeding ₹10,000 made via UPI, IMPS, or RTGS. During this "cooling-off" period, the funds would be provisionally debited from the sender's account but held by the bank, providing users a critical window to review and cancel the transaction if they suspect they are being defrauded.

This targeted approach comes in response to data showing that while high-value frauds (above ₹10,000) account for roughly 45% of cases by volume, they represent a staggering 98.5% of the total ₹22,931 crore lost to digital fraud in 2025. Most of these crimes utilize social engineering tactics—such as impersonation and deepfakes—to pressure victims into making instant, irreversible transfers. To ensure that routine commerce is not disrupted, the RBI has clarified that the delay will not apply to verified merchant payments, auto-debits, or cheque transactions. Furthermore, a "whitelisting" feature is proposed, allowing users to pre-approve trusted contacts for instant transfers without any delay.

Beyond the one-hour hold, the RBI has outlined advanced safeguards for vulnerable sections of society. For senior citizens (aged 70 and above) and persons with disabilities, the central bank suggests an additional layer of verification for transactions exceeding ₹50,000, potentially requiring approval from a nominated "trusted person". Another significant safety feature proposed is a single-step "kill switch". This would allow customers to instantly block all outgoing digital payments and disable internet banking access across all platforms through a mobile app, hotline, or IVR if their phone is lost or fraud is suspected.

To address the growing network of "mule accounts" used to launder stolen funds, the RBI proposes linking account activity strictly to a customer’s verified profile. Accounts with unverified or low income might face an annual credit cap of ₹25 lakh unless they undergo enhanced due diligence. Additionally, the regulator suggests that digital payment features could be disabled by default for newly opened accounts to prevent them from being immediately used for fraudulent activity. The public and financial stakeholders have until May 8, 2026, to provide feedback on these proposals before final guidelines are issued.