Discuss how inter-agency platforms like the Digital Intelligence Platform and the Financial Fraud Risk Indicator turn telecom data into financial-sector security. What privacy safeguards are needed? (15 m)

Almost every cyber-fraud uses two things: a mobile number and a bank account. The Department of Telecommunications' (DoT) Digital Intelligence Platform (DIP) now links over 1,600 stakeholders [1]. Together with its risk score, the Financial Fraud Risk Indicator (FRI), it joins up these two chains so that telecom signals can stop money before it moves.

How telecom data becomes financial security

• Pooling intelligence: FRI rates a number as Medium, High or Very High risk. It draws on reports to I4C's cybercrime portal (NCRP), citizens' Chakshu complaints and inputs from banks [2].
• Stopping fraud before payment: Banks and UPI apps can delay or block transfers to numbers flagged as risky. This has prevented over ₹5,000 crore of suspected losses [1].
• Regulatory backing: In June 2025, RBI advised banks to integrate FRI [3]. Over 1,000 banks, third-party UPI apps (TPAPs) and payment operators have joined DIP [4].
• Two-way sharing: Under the DoT–SEBI MoU, DoT shares FRI and its list of revoked mobile numbers with market intermediaries. In return, SEBI reports numbers linked to mule accounts [5].
• Checking identity: The Mobile Number Validation platform checks whether a number really belongs to the account holder. This targets mule accounts [6].

Chakshu / NCRP / Banks ──► DIP ──► FRI risk score ──► Bank/UPI/SEBI action
          ▲                                                  │
          └────────── DoT disconnects flagged numbers ◄──────┘

Fig: Telecom–finance intelligence loop

Privacy concerns

• Subscriber data now reaches 1,600+ entities [1]. This creates a risk of function creep (data being used for purposes beyond fraud control) and profiling.
• FRI flags suspected fraud. A wrong flag can freeze a genuine user's payments, and no data on errors or appeals is published.
• The pre-installation mandate was withdrawn in December 2025, which exposed a trust deficit. The government stressed that the app works only with user consent and can be deleted [7].

Safeguards needed

• Lawful and proportionate use: Apply the DPDP Act, 2023 principles of purpose limitation, data minimisation and breach notification [8]. Meet the Puttaswamy (2017) test of legality, necessity and proportionality.
• Access control and audits: DIP is already closed to the public, with role-based access [4]. It should also have independent audit trails.
• Redress: Inform users who are flagged, offer time-bound appeals and publish data on wrongful disconnections.
• Oversight: Set data-retention limits and report regularly to Parliament.

DIP and FRI show how a whole-of-government approach can turn scattered telecom signals into financial protection. Building privacy-by-design into them would keep trust in the system as strong as its reach, protecting both citizens' money and their Article 21 right to privacy.