India’s fintech story is usually told through innovation at scale. UPI handled roughly 2,366 crore transactions worth ₹29.87 lakh crore in July 2026 alone, according to a government backgrounder on UPI. Numbers like these explain how quickly digital finance became ordinary. As the pace of technology accelerates with AI and a convergence of agentic and financial technologies, a lot of responsibility now rests, increasingly, on cybersecurity.
A threat surface that grew with adoption
Cybersecurity incidents in India rose from 10.29 lakh in 2022 to 22.68 lakh in 2024, according to a Press Information Bureau note on cyber fraud. The same note records that the national cyber fraud reporting system has helped save over ₹5,489 crore across more than 17.82 lakh complaints. Speed of response, not just strength of prevention, now decides how much a fraud actually costs a household.
From guidance to obligation
Regulators have moved security from best practice to binding requirement, and from the IT team to the boardroom. CERT-In’s 2022 directions require specified incidents to be reported within six hours, and system logs to be kept for 180 days within India. The RBI’s Master Direction on IT governance, in force since April 2024, calls for a board-level IT strategy committee and a security chief independent of the IT function. SEBI followed with its cyber resilience framework for market entities.
The Digital Personal Data Protection Rules, 2025 give organisations 18 months to comply, with penalties of up to ₹250 crore for failing to maintain reasonable security safeguards, as the government’s explainer notes. The RBI’s authentication directions for digital payments, effective April 2026, let issuers add risk-based checks beyond the SMS OTP. The common thread is accountability. Security must now be demonstrated, not merely claimed.
The weakest link is rarely the code
Most fraud that dents public confidence starts with a phone call, a fake link or a borrowed bank account, not a breached server. No single institution sees enough of the pattern to stop it alone, which is why the focus is shifting to shared intelligence.
The RBI’s MuleHunter.AI is live in 26 banks, and the Indian Digital Payment Intelligence Corporation was set up in October 2025 to tackle payment fraud at a system level, according to a March 2026 government update.
The RBI has also proposed revising its rules on customer liability for unauthorised transactions, including compensation for small-value frauds. If finalised, firms that fail to stop preventable fraud may increasingly bear its cost.
Security as part of the product
Every added check reduces risk and adds friction, and customers abandon products that feel like obstacle courses. The firms that get this right keep protection proportionate: invisible for routine activity, firm when behaviour looks unusual, and clear about why a transaction was paused. Communication matters just as much. An incident disclosed promptly and plainly can leave trust intact. Silence or vague reassurance can damage it far beyond the actual loss.
What comes next
Artificial intelligence will sharpen both sides. The tools that help institutions spot anomalies also let fraudsters clone voices and run personalised scams cheaply. Defences built for yesterday’s attacks will age quickly.
Trust in finance compounds slowly and breaks quickly. Indian fintech spent a decade proving that digital money could be fast, cheap and inclusive. The next decade will test whether it is dependable under pressure. Cybersecurity is no longer the price of entry to that conversation. It is a conversation.
