"The success of UPI has also enlarged India's cyber-fraud attack surface." Critically examine, and suggest a multi-stakeholder response.

UPI processed over 24,000 crore transactions worth ₹314 lakh crore in FY 2025-26 [1]. Yet the Status of Policing in India Report (SPIR) 2026 finds that the most trusting, most frequent UPI users were more likely to be cybercrime victims [1]. UPI's success has widened the attack surface. But the weakness lies less in the payment rail itself than in the human and institutional layers around it.

How UPI's success enlarged the attack surface

• Scale of exposure: ~70% of Indians are online, and 49% of the SPIR sample use UPI daily. That gives fraudsters a vast pool of targets [1].
• Frictionless design: a routine "scan, PIN, beep" dulls vigilance, which fake apps and phishing exploit [1].
• Fear-based fraud: "digital arrest" scammers impersonate CBI, NCB, RBI and police, often through spoofed international calls [5].
• Mule accounts: 32.08 lakh first-layer mule accounts (accounts rented or borrowed to receive stolen money) have been flagged through the Suspect Registry [2].

Why the claim needs qualification

• Correlation, not causation: daily users simply face more attempts. SPIR shows which way the risk points, not that UPI causes fraud [1].
• Secure rail, tricked user: in digital-arrest and fake-app scams the victim usually enters the PIN, so the gap is social engineering, not UPI's architecture [5].
• Institutional gaps: RBI's 2017 zero-liability rule covers only unauthorised transactions [3]. Of ₹56,087 crore reported lost (FY24–26), only ~₹9,079 crore was frozen. And ~53.87 lakh complaints yielded just ~1.81 lakh FIRs [2].
• Pre-emption works: the Suspect Registry led to ₹25,698 crore of transactions being declined [2].

Multi-stakeholder response

• RBI: finalise the March 2026 draft that widens liability cover and compensates small-value frauds [4].
• Banks and RBIH: tighter KYC; AI-based mule detection under the I4C–RBIH MoU [6].
• NPCI and apps: add friction only where risk is high, such as warnings or delays on large payments to first-time payees.
• States and police: scale up e-Zero FIR nationwide [7]; train district cyber cells.
• Telecom operators: block spoofed calls [5].
• Citizens: practise cyber-hygiene and report promptly on helpline 1930.

UPI's success has enlarged the attack surface mainly because adoption outpaced safeguards, liability rules and policing. The response should shift from recovering money after fraud to preventing it, through mule blocking, safety-by-design and shared liability. That would make users' trust well-placed and sustain Digital India's promise of secure financial inclusion (SDG 8.10).