Skip to content
Try one-tap loginBook a demo

UPI fraud prevention. A payment held before the PIN is asked for.

A new payee by VPA, an amount 14 times the usual, a call that has run for 41 minutes. DeepID reads the session and returns a hold with its reasons before the UPI PIN is asked for, and the customer sees why, in the language they read.

Book a demoIndia’s rules, mapped
The customer reads it in
Illustrative. The customer’s own bank app, with DeepID’s decision inside it. “We’ll call you on your registered number within 10 minutes” is the bank’s own promise to its customer, written by the bank.
On this page

Where DeepID reads a UPI journey.

Five moments, from registration to a new phone. Each is checked against what was bound before it, and each has a module that reads it.

  1. Registration

    The SIM in the phone is matched to the registered number, and the app is bound to the device.

    The module behind it: SIM and device binding

  2. Login

    The bound SIM, the known device and the owner’s rhythm sign the customer in, with nothing to type.

    The module behind it: Silent network verification

  3. New payee

    The moment scams and mules need: who is the payee, and is the customer under pressure?

    The module behind it: Payee and mule graph

  4. Payment

    One decision before the UPI PIN is asked for, with its reasons in the bank’s FRM.

    The module behind it: One decision, with reasons

  5. PIN reset or new phone

    A fresh check, such as Aadhaar face authentication with consent, before the new phone is trusted.

    The module behind it: Liveness and face match

What the bank’s side reads, step by step.

The same payment from the bank’s side: the payee, the amount, the intervention and the hold, with the state of the session in its own column.

  1. PayeeNew payee r.sharma77@okbank, added 3 minutes ago. Never paid before, and linked to 14 other accounts.Watch
  2. Amount₹96,000: 14 times this customer’s usual. A call has been active for 41 minutes and the screen is shared.Risk
  3. InterventionBefore the UPI PIN is asked for, DeepID returns a hold with its reasons, and the app shows the customer the message in the language they read.Hold
  4. HeldThe payment is never created. The FRM receives the event with its reasons, and the bank’s call-back team is queued.Sent

An illustrative session in the numbers this site uses throughout: ₹96,000, a payee added 3 minutes ago, a 41-minute call. Thresholds and actions are your policy, set per journey.

The messages, in English and हिन्दी.

Written for the customer, not the analyst, and shown only when the session calls for it. The bank’s own words replace these before launch.

Is someone on the phone asking you to send this?

Banks, police and courts never ask you to move money to keep it safe. There is no such thing as a “digital arrest”.

Yes, someone asked me toNo, it’s just me

The questionEnglish

क्या फ़ोन पर कोई आपसे ये पैसे भेजने को कह रहा है?

बैंक, पुलिस या अदालत कभी भी पैसे सुरक्षित रखने के नाम पर उन्हें कहीं और भेजने को नहीं कहते। “डिजिटल अरेस्ट” जैसी कोई चीज़ नहीं होती।

हाँ, किसी ने भेजने को कहा हैनहीं, यह मेरा अपना फ़ैसला है

The questionहिन्दी

Payment paused

₹96,000 is still in your account. We’ll call you on your registered number within 10 minutes. Worried? End the call and dial 1930, the national cyber crime helpline.

The holdEnglish

भुगतान रोक दिया गया है

₹96,000 अभी आपके खाते में ही है। हम 10 मिनट के अंदर आपके रजिस्टर्ड नंबर पर कॉल करेंगे। चिंता हो तो कॉल काटें और राष्ट्रीय साइबर अपराध हेल्पलाइन 1930 पर कॉल करें।

The holdहिन्दी

Illustrative messages. 1930 is India’s national cyber crime helpline. The Hindi lines are reused from reviewed copy and are read again by a native speaker before launch.

NPCI context.

What UPI already asks of the app, and what DeepID adds inside the bank’s own app.

  • UPI onboarding: device and SIM binding

    Current onboarding requirement

    UPI onboarding binds the app to the device and needs an active SIM linked to the bank account.

    DeepID: SIM binding at onboarding and UPI registration, binding again with a fresh check when the SIM or phone changes, and SIM-swap checks at login.

    NPCI (UPI user onboarding: product overview, opens in a new tab), as of Oct 2026

SIM and device binding, compared

What your FRM receives.

The same decision, as an event, before the payment is created. Your FRM keeps its rules, queues and cases.

frm-event.jsonIllustrative field names
{  "event": "payment.initiate",  "session": "S-0412",  "decision": "HOLD",  "next": "call_back_registered_number",  "reasons": ["ACTIVE_CALL", "SCREEN_SHARED", "PAYEE_MULE_LINKED"],  "signals": { "sim": "bound", "device_days": 412, "payee_age_min": 3, "amount_vs_usual": 14 },  "customer_message": { "lang": "hi", "shown": true },  "payment_created": false}

Read next

See DeepID on a real phone.

We show your fraud, security and engineering leads how DeepID would run your sign-up, login or payment journey, then plan a pilot on your own traffic.

Book a demoTry one-tap login