ETtech Explainer: Why NPCI is pulling the plug on fraud-prone pull payments on UPI

The National Payments Corporation of India (NPCI) is planning to slowly phase out pull payments on the Unified Payments Interface (UPI), a popular retail payments mode.

While this is not the most commonly used payment flow on UPI, it comes at a time when there is a manifold jump in frauds on digital payments. Perhaps this is one of the first instances of a product innovation being shelved because of it being prone to fraud attacks. ET explains what this means and what is the potential impact on consumers.

Also Read: NPCI looking to stop cons ‘pulling’ a fast one via UPI

Understanding UPI flows

UPI users can make payments via the following methods:

• Scan and pay via QR codes
• Transfer to someone’s mobile number linked with the bank account and UPI ID
• Transfer to a particular UPI ID, if the payer knows the payee
• A payee can initiate a pull transaction from the payer’s account

It is the fourth payment flow which is being phased out by the NPCI. And it is not for all forms of payments, but specifically for merchant transactions. Person-to-person (P2P) payments will continue but with a limit of Rs 2,000.

Why is this being done?

Given that the awareness about digital payments and mobile banking is low in India, a lot of frauds are happening on UPI. Fraud attacks on pull transactions are perhaps the most common ones taking place. Users unknowingly authenticate a transaction via their mobile banking or UPI application, only to realise later that funds have been debited from their bank accounts.

Why are pull transactions more prone to fraud?

In a pull transaction, the beneficiary has a higher degree of control over the transaction. The merchant inputs the amount and asks the user to pay. For the user, it is just a matter of one pin and the transaction flows. In many cases, an unmindful user does not realise that he has authenticated an account debit. Bankers say many such cases are flagged to them, where there is hardly any recourse for the user because he has himself authenticated the transaction.

Impact on the sector

For users, the impact will be minimal because they can continue using UPI’s other payment flows safely. For P2P payments they can share QR codes or just send the payer their virtual ID for a transaction.

For smaller merchants and direct-to-consumer (D2C) brands this could be a major problem. They will have to work with payment aggregators like Juspay, Razorpay or their banks to build a proper payment flow, undertake know your customer (KYC) formalities to enable card, netbanking and UPI payments. NPCI wants online merchants to mostly move to a QR code flashing on the screen of the customer’s device.

Per industry insiders, with the growing popularity of UPI QR codes, pull transactions had declined to less than 3% of the total volume of payments.

If anyone still wants to initiate a pull payment from someone, they can do so for up to a limit of Rs 2,000, thereby keeping accounts safe.

Also Read: Government weighs return of merchant charges on UPI, RuPay