Fintech Deep Dive — Saturday | July 11, 2026

Theme: Consumer Rights — Complaints, Fraud, and Safeguards

This week saw a flurry of consumer protection measures from the RBI, a chilling Bluetooth-based security vulnerability affecting millions of e-rickshaw drivers, and renewed attention to fraud compensation frameworks. Here are the five most significant developments shaping consumer rights in Indian fintech.

1. RBI’s Digital Fraud Compensation Framework: A Landmark (But Imperfect) Safety Net

On June 24, the RBI issued final amendments to its “Limiting Customer Liability in Digital Transactions” framework, introducing a first-of-its-kind pilot compensation scheme for victims of digital banking fraud. The scheme, effective January 1, 2027, offers a one-time lifetime benefit to individual customers (including sole proprietors) who suffer losses due to fraudulent electronic banking transactions.

How the compensation works

The framework covers two distinct scenarios of fraud:

• Third-party fraud using stolen credentials: Transactions executed by a fraudster who obtained the customer’s credentials through deceptive means.
• Coerced transactions: Transactions executed by the customer under duress or coercion from a third party.

For eligible losses, compensation is calculated as 85% of net loss, capped at ₹25,000, whichever is lower. The scheme covers losses up to ₹50,000 — for losses between ₹29,412 and ₹50,000, the payout is a flat ₹25,000. Scams exceeding ₹50,000 are excluded from this scheme entirely.

The critical conditions

To qualify, victims must:

1. Report the fraud to their bank within five calendar days of the transaction.
2. File a complaint with the National Cyber Crime Reporting Portal (1930).
3. Not have contributed to the fraud through gross negligence or shared credentials voluntarily.

If the fraud resulted from the bank’s own negligence or deficiency, the customer is entitled to zero liability and full reversal — regardless of reporting timeline. This existing protection, part of the 2017 framework, remains unchanged.

Analysis

This is a significant acknowledgment that digital fraud victims need more than just reversal timelines — they need actual financial support when money is gone and recovery fails. The ₹25,000 cap, however, is modest relative to the scale of digital fraud losses in India (UPI alone processed ₹28.9 lakh crore in June 2026). The one-time-per-lifetime limitation is also concerning — a repeat victim of different scams gets nothing the second time around.

The pilot designation suggests the RBI may expand or revise the parameters based on experience. Banks and payment system participants will bear the compensation cost, creating an incentive to invest in fraud prevention upstream.

Sources: The Hindu — RBI’s Digital Scam Compensation Pilot, Insights on India — RBI Scam Compensation Framework, Ujjivan SFB — RBI’s New Digital Fraud Rules

2. The E-Rickshaw Bluetooth Hack: When IoT Vulnerability Meets Street-Level Harm

In what became one of the most striking consumer safety stories of the week, the Indian government on July 3 directed Google and Apple to remove at least three (possibly up to seven) battery management apps — including BAT-BMS, Epoch Li-ion, and Lossigy — from their app stores. The reason: freely downloadable apps were being used to remotely shut down moving e-rickshaws by exploiting unauthenticated Bluetooth connections to battery packs.

The vulnerability explained

Many modern e-rickshaws use lithium-ion battery packs with a Bluetooth-enabled Battery Management System (BMS). These BMS apps are designed for legitimate maintenance — monitoring voltage, temperature, and charge cycles. However, most low-end battery packs ship with no default password or Bluetooth authentication. Anyone within 10-15 metres running a compatible BMS app can pair with the battery and flip its discharge switch, cutting power to a moving vehicle.

Real-world impact

The “Tirri” prank trend went viral on social media, with videos showing strangers disabling e-rickshaws mid-ride. But the consequences were serious:

• Drivers reported being stranded, losing a day’s earnings (₹400-₹1,000 daily income reduced to as low as ₹600).
• Incidents were reported near Delhi University’s North Campus, Jamia Millia Islamia, Sikandarpur (Gurugram), and Patna.
• At least one arrest was made in Ujjain where the method was allegedly used for extortion.

Government response

MeitY Secretary S. Krishnan confirmed the takedowns at the CII Cybersecurity Summit on July 3. This was an administrative store-level removal, not a formal Section 69A ban. Officials indicated they were still examining whether to invoke Section 69A for a formal block. Misuse can be prosecuted under existing IT Act provisions (Sections 43 and 66).

What the ban does not fix

Pulling apps from stores addresses the immediate vector but does not close the underlying hardware vulnerability. Any other compatible BMS tool — now or in future — could exploit the same open Bluetooth interface. Until battery manufacturers are required to implement authentication, the risk persists for millions of e-rickshaw drivers.

Sources: Indian Express — Earnings of Delhi’s E-Rickshaw Drivers Hit by Bluetooth Hack, Ministry of Cyber Affairs — How Chinese Battery Apps Could Remotely Stop a Moving E-Rickshaw, Business Today — BT Explainer: The Chinese App, E-Rickshaw Shutdowns

3. RBI Bars Banks from Charging for SMS Alerts — A ₹300 Crore Hit for Lenders

The RBI’s June 24 circular banning banks from charging customers for SMS alerts sent for compliance, awareness, or promotional purposes has emerged as one of the most impactful consumer protection moves this week, with industry estimates suggesting banks could lose up to ₹300 crore annually in fee income.

The details

Previously, most banks charged customers ₹15-18 per quarter for SMS notification services — a revenue stream that was essentially a customer paying to be informed about their own money. The RBI’s revised guidelines prohibit recovering charges for:

• Regulatory compliance alerts (mandatory)
• Customer awareness messages
• Promotional communications from the bank

The RBI has also encouraged banks to shift to digital communication channels — Google RCS, WhatsApp, mobile banking app notifications, and push alerts. For transactions of ₹500 or less, banks are not required to send SMS alerts at all, and can use alternative digital platforms instead.

Why it matters

India generates an estimated 60-80 billion business SMS messages per month. For consumers, this is a direct saving — no more paying for the privilege of knowing your account balance dropped. For banks, it accelerates the shift away from legacy SMS infrastructure toward push notifications and in-app messaging, which are cheaper and more secure.

The ₹300 crore figure, reported by the Economic Times and confirmed by banking officials, represents the scale of what was effectively a regressive fee — one that disproportionately affected customers with smaller balances who could least afford it.

Sources: Outlook Business — RBI Bars SMS Alert Charges, Pune Pulse — RBI Directs Banks to Stop Charging, Economic Times — Cost of Free Alerts

4. RBI’s Proposed UPI Cooling-Off Period: A Bold Anti-Fraud Move Still in Discussion

Adding to the week’s consumer protection momentum, the RBI has proposed a one-hour cooling-off period for certain Person-to-Person (P2P) UPI transfers above ₹10,000. This is currently a proposal, not a final rule, but its implications are significant enough that it has generated wide discussion across the fintech ecosystem.

How it would work

Under the proposal, qualifying high-value P2P UPI transfers would be placed on hold for up to one hour before completion. If the sender realizes they’ve been scammed or sent money to the wrong person, they would have a short window to cancel the transaction before the money reaches the fraudster.

The framework is specifically targeted at P2P transfers — merchant payments and other transaction categories would likely be excluded to avoid disrupting commerce.

The trade-off

A one-hour delay introduces a fundamental tension between speed and safety. UPI’s killer feature has always been instant settlement — the “it happens in real-time” experience that drove adoption to 75 crore daily payments. For legitimate users sending money for urgent needs (medical emergencies, time-sensitive payments), an hour’s delay could be frustrating.

The proposal also raises implementation questions: Would the hold apply at the PSP level or the bank level? How would refunds work if the sender cancels mid-window? Would fraudsters simply adapt by breaking large requests into multiple smaller ones below the threshold?

For now, this remains a discussion draft. If implemented, it would be the most aggressive consumer protection intervention in UPI’s history — a recognition that the system’s speed, once its greatest asset, has also become its greatest vulnerability in the hands of scammers.

Sources: Instagram — ET / UPI Cooling-Off Proposal, LinkedIn — 1-Hour Payment Lag

5. NPCI Strengthens UPI Privacy: Masking User IDs, Mobile Numbers, and Account Numbers

On June 5, NPCI directed all UPI member banks and apps to strengthen user privacy by masking sensitive identifiers on customer-facing interfaces. The directive requires masking of:

• UPI IDs
• Mobile numbers linked to UPI handles
• Account numbers

The move addresses a longstanding concern: UPI apps and bank interfaces that expose full mobile numbers or UPI IDs create opportunities for social engineering attacks, phishing, and harassment. A fraudster who sees your phone number on a payment receipt can use it as the starting point for a vishing (voice phishing) attack.

Context

This privacy directive builds on a broader regulatory trend. The RBI’s 2022 Digital Lending Guidelines already restrict over-collection of contacts, gallery, and location data by lending apps. The DPDP Act 2023 now makes excessive data collection a statutory consent violation. NPCI’s masking requirement is the payments-layer implementation of this principle — minimizing data exposure at the point of transaction.

For consumers, this means fewer visible personal identifiers when making or receiving payments. For the ecosystem, it raises the bar for fraudsters who relied on exposed data to social engineer their targets.

Sources: LinkedIn — CUBE Fintech Ecosystem Update, Aakhya Weekly — Inside India’s Digital Currency Debate

The Week in Summary

This was a strong week for consumer rights in Indian fintech, driven primarily by regulatory action rather than market forces. The RBI continues to push banks toward zero-liability frameworks for fraud victims, while the e-rickshaw incident exposed how IoT security failures can have immediate, physical consequences for some of India’s most vulnerable workers.

The common thread: consumer protection is catching up to the speed of digital adoption, but gaps remain — particularly in hardware security standards, compensation adequacy, and the tension between instant payments and fraud prevention.

Covering developments from July 4–11, 2026. Published automatically as part of the CashlessConsumer Fintech Deep Dive series.