The Department of Pending Charges

Recovered from the 2046 archive of the Ministry of Later. All future events and testimonials below are fictional; the 2026 events in the fact box are real.

Future headlines from the week convenience learned to wait

• UPI fee postponed until after Diwali; citizens advised to keep a calendar beside the QR code
• Customer data receives standard rate card; customer remains its most enthusiastic stakeholder
• Twenty financial institutions learn that a valid credential can be an invalid excuse

I work at the Department of Pending Charges, preserving announcements until the public has finished celebrating. Our founding exhibit is a 2026 notice: a UPI merchant fee, due October 15, postponed until after Diwali without a replacement date.

“Was it cancelled?” visitors ask.

“No. It moved to a more festive place on the calendar.”

“Would the customer pay?”

“No. The merchant-side MDR was not supposed to be charged to consumers or added separately to their bill. The official FAQ even assured us prices would not rise.”¹

“Then why ask for a delay?”

I admire the question. In 2046, children ask why a cost is harmless just because the invoice goes elsewhere. A ban on separate surcharges helps; it cannot promise every business will keep prices unchanged for any reason. The fee remains, awaiting a new date. The joke is not that UPI customers were secretly charged—they were not. It is that we call a cost settled while its rollout date is pending.

Our second exhibit is a glass pipe labelled YOUR DATA, ON CONSENT. From November 1, standard Account Aggregator pricing meant financial firms requesting customer data would pay a fee shared by the data-holder, the AA and Sahamati. Customers could not be directly charged for sharing; lender requests still required their consent, and AAs carry the data without reading or storing it.²

“Is the information mine?” asks a schoolchild.

“Yes.”

“Then why is there a price?”

“To pay for the pipe.”

“Does paying for the pipe buy the person who owns the water?”

The curator coughs. The lender pays; standard funding may support reliable infrastructure. That is not evidence of misuse. But consent alone doesn’t answer: what is the purpose, how long does permission last, can a person refuse without losing a fair alternative, and how can a bad credit decision be challenged? A safer pipe can also make sharing routine. The public needs clear controls, not just a tap marked I AGREE.

The third exhibit is an API key, mounted like a museum dagger. On October 15, The Economic Times reported attacks affecting about 20 financial institutions earlier that month. Its account of a CERT-In advisory said stolen partner-bank, payment-aggregator or gateway credentials were used to initiate fraudulent transfers through institutions’ interfaces; the scale of losses was not independently established.³

“Was the payment authorised?” asks a visitor.

“The system accepted a credential.”

“That was not my question.”

Precisely. A valid key can open a door for someone who should not be there. This is not proof every fintech is compromised or every customer lost money. It shows why institutions must secure third-party connections, verify payouts against approved transactions and detect abuse of trusted interfaces.

In the future, we printed customer testimonials on the exhibit wall. These are fictional, not reports from real people:

“The shopkeeper said there was no UPI surcharge. The price was the price. I still asked what the next price would be, because the fee had a better travel itinerary than I did.” — fictional shopper, 2046

“I gave permission to share my statement for a loan. I did not give permission for the decision to become a riddle. Show me the purpose, the facts used and the person who can correct them.” — fictional borrower, 2046

“The dashboard said the transfer came from an authorised system. My bank balance said the system had not asked me.” — fictional account-holder, 2046

The Real Threat Behind the Joke

What actually happened this week (October 10–17, 2026)

• On October 13, NPCI postponed the MDR rollout, previously due October 15, until after Diwali; no new date was set. The framework sets a 0.4% merchant fee on eligible P2M transactions above ₹2,000, with category terms and caps. The FAQ says consumers are not charged and merchants cannot add it as a separate surcharge.¹
• A standard Account Aggregator pricing model was reported on October 13 as taking effect November 1. Financial firms requesting data pay; customers cannot be directly charged for AA data sharing. The fee is per successfully shared account and varies with the period of data requested.²
• On October 15, The Economic Times reported the attacks and CERT-In’s October 9 advisory on compromised interfaces and credentials. The number affected was reported as about 20; loss estimates were not independently established in the article.³

What you can do

1. Pay the displayed price, not a made-up UPI “customer MDR.” If separately surcharged, keep the bill and complain to the payment app or acquirer. Follow NPCI for the new rollout date; ignore fee rumours.
2. Treat data consent like a loan term. Check who requests the AA data, why, which accounts and dates, and for how long. Save the consent record; revoke access when appropriate. Compare a digital loan’s Key Fact Statement and APR, and ask how to dispute errors.
3. If money moves without approval, contact your bank immediately. Keep transaction IDs and report through its official fraud channel or helpline 1930.⁴ Never share OTPs, passwords or screen access with anyone promising a reversal.

The Department of Pending Charges has one final rule for its tour guides: never confuse the customer was not billed directly with the customer has no questions. A payment system earns trust not by promising that every cost is invisible, every data request benevolent or every credential safe, but by making the rules legible—and giving people a way to say no, ask why and get help when something goes wrong.