Digital Banking, Payment Systems and Cyber-Fraud Safety

This chapter answers the digital-banking and payments part of the Banking and Financial Awareness section used by IBPS Clerk, SBI Clerk, IBPS PO, SBI PO and IBPS RRB: UPI, IMPS, NEFT, RTGS, BBPS, cards, CBDC, internet and mobile banking, the account aggregator, digital lending and fraud reporting. The mechanisms (who settles, how a payment is authorised, who is liable) are stable. Limits and new products are not, so every number below carries the month in which it was checked (October 2026, unless another date is given) and its source; in the examination, a question that quotes a limit is testing the mechanism around it. Where the text says 'per RBI' or 'per PIB' it is quoting that official page.

Who runs payments: RBI, NPCI and the four transfer rails

The Payment and Settlement Systems Act, 2007 gives RBI the power to authorise and regulate payment systems. NPCI (National Payments Corporation of India), set up in 2008 with guidance from RBI and the Indian Banks' Association as a not-for-profit company, runs the retail systems: IMPS, UPI, RuPay, BBPS, AePS and others. RBI itself runs RTGS and NEFT.

The four rails compared
RailHow it settlesHours and amount (as of October 2026, per RBI)
RTGSGross: each transfer settles individually and at once, in RBI's books, and is final24x7 since 14 December 2020; minimum ₹2 lakh, no upper cap; beneficiary bank credits within 30 minutes
NEFTBatches every half hour24x7; RBI sets no limit (banks may); credit within 2 hours of batch settlement; cash remittance by a person without an account up to ₹50,000 a transaction
IMPSInstant, run by NPCI24x7, every day of the year
UPIInstant, bank to bank, through NPCI24x7; limits differ by purpose and bank

The word gross is the key to RTGS: it never nets one payment against another, so a large payment is settled the moment it is processed and cannot be recalled. That is why it suits large values and why it has a minimum. A transfer of ₹1.5 lakh cannot go by RTGS, but can go by NEFT or IMPS. All four settle in the books of banks and RBI; none moves physical cash.

⚠️ Do not swap the RTGS and NEFT facts
Old coaching notes say NEFT works only in office hours in batches and RTGS only from 7 am to 6 pm. Both are now round-the-clock. What still separates them is settlement: RTGS is gross and individual, NEFT is in half-hourly batches, and only RTGS has a minimum amount.

UPI: how it works and its products

UPI (Unified Payments Interface) was developed by NPCI. It began as a pilot in April 2016 with 21 member banks and was opened to the public in August 2016; the BHIM app followed in December 2016 (per PIB). One mobile app can hold several bank accounts. Money moves directly from the payer's bank account to the payee's, so no wallet needs loading and no account number is shared.

  • A virtual payment address (VPA) such as name@bank stands in for the account number and IFSC.
  • Two checks protect a payment: the registered device and SIM binding, and the UPI PIN, which the customer sets with their own bank.
  • In a pay request the payer sends money. In a collect request the payee asks, and the payer approves by entering the PIN.
  • A static QR carries only the payee's details; a dynamic QR also carries the amount and transaction details.
🧠 The PIN only ever sends money out
Receiving money never needs a PIN. If anyone, on a call or a QR code, asks you to enter your UPI PIN 'to receive' money, you are in fact authorising a payment from your account. Say it to yourself as: PIN = pay out.

Products built on UPI (per PIB, August 2026): UPI Lite for small PIN-less payments from an on-device balance, with a limit of ₹1,000 a transaction and ₹5,000 wallet balance; UPI 123PAY for feature phones through IVR calls, an app, missed calls or proximity-sound payments, with a limit of ₹10,000 a transaction; UPI AutoPay for recurring mandates such as subscriptions, premiums and EMIs; UPI Circle, where a primary user lets secondary users pay within set limits from the primary user's account. For tax payments the per-transaction limit was raised from ₹1 lakh to ₹5 lakh, and higher limits apply to selected categories such as capital markets, insurance, healthcare and education.

Worked example. Take the August 2026 UPI Lite limits (₹1,000 a payment, ₹5,000 balance). Priya's wallet is full. She pays ₹900, ₹750 and ₹600, a total of ₹2,250, so ₹2,750 is left. She can load back at most ₹2,250, because the balance may not exceed ₹5,000. Each of the three payments was within the per-payment cap of ₹1,000.

Cards, networks and secure card payments

A debit card draws on the balance in the customer's account at once. A credit card gives a revolving credit line: the bank pays the merchant, the customer repays later, and interest accrues on the part not repaid by the due date. A prepaid card is loaded with money in advance. Two banks sit behind every purchase: the issuer (the customer's bank, which gave the card) and the acquirer (the merchant's bank, which lets the merchant accept cards). The card network connects them: RuPay is India's own, introduced by NPCI in 2012; Visa and Mastercard are the international networks.

Security in layers. A chip-and-PIN card is harder to clone than a magnetic stripe, which is what skimmers copy. For online and other card-not-present payments RBI requires an additional factor of authentication (AFA), usually an OTP, beyond the card details. Tokenisation goes further: the card number is replaced by a token that is specific to that card and that merchant, so a leak at the merchant gives the thief nothing usable elsewhere. Since 1 October 2022 no entity in the payment chain other than the card issuer and the card network may store card-on-file data, and the customer's consent to tokenise must be explicit and authenticated by AFA, never a pre-ticked box.

⚠️ Issuer and acquirer are easily swapped
The issuer faces the cardholder; the acquirer faces the merchant. If a question says 'the bank that installed the POS machine at the shop', that is the acquirer. If it says 'the bank that issued the card to the customer', that is the issuer.

BBPS, AePS, CBDC and the account aggregator

BBPS (Bharat Bill Payment System) is an RBI-mandated, interoperable platform for utility bills such as electricity, water, gas, telecom and DTH, reachable through bank branches, apps and agents. It is run by NPCI Bharat BillPay Ltd. (NBBL), a wholly owned subsidiary of NPCI; NPCI is the authorised central unit that sets its standards and settles it.

AePS (Aadhaar Enabled Payment System) lets a customer do cash deposit, withdrawal, balance enquiry and mini statement through a bank's business correspondent using a micro-ATM, with only the Aadhaar number, the bank's name and a biometric fingerprint. UIDAI authenticates the biometric; NPCI switches, clears and settles the transaction. It matters in villages with few branches.

CBDC. The digital rupee (e₹) is the digital form of legal tender, issued by RBI as a token. The wholesale pilot (e₹-W) began on 1 November 2022, first for settling secondary-market trades in government securities; the retail pilot (e₹-R) began on 1 December 2022 in a closed group of customers and merchants. RBI's FAQ (October 2026) still describes e₹ as being piloted. It differs from UPI: UPI instructs a transfer of commercial-bank deposit money, while e₹ is central-bank money itself, like a note in digital form.

Account Aggregator (AA). An AA is an NBFC licensed by RBI to move a customer's financial data with the customer's consent. The framework went live on 2 September 2021. The data holder is the financial information provider (FIP), such as a bank; the data user is the financial information user (FIU), such as a lender. A consent artefact records what data, for what purpose and for how long. The AA only passes the data on, and does not keep it or read it. This is how a loan applicant can share bank statements without emailing PDFs.

Cyber-frauds and the habits that stop them

FraudHow it works
PhishingFake email or website that imitates a bank and collects credentials
VishingA phone call by a person posing as bank staff who asks for OTP, PIN or card details
SmishingAn SMS with a link to a fake site or a number to call
SIM swapThe fraudster gets a duplicate SIM issued on forged documents and so receives the victim's OTPs
SkimmingA device on an ATM or POS copies the magnetic stripe and a hidden camera records the PIN
Remote-access scamThe victim is persuaded to install a screen-sharing app, which exposes OTPs and PINs
Mule accountAn account lent or opened with false identity to pass stolen money along

The defences follow one rule: the secret is never shared. A bank never asks for an OTP, PIN, CVV or password by call, SMS or email. Install apps only from official stores, never grant screen-sharing to a stranger, check a link before opening it, and use a bank's number printed on its card or official site, not one found through a search result or sent in a message. If a call pressures you to act now, that pressure is itself the warning sign.

⚠️ Vishing, smishing and phishing differ by channel
Voice call is vishing, SMS is smishing, email or website is phishing. SIM swap is different again: no message needs to be answered, because the fraudster takes over the victim's number. A question that stresses 'duplicate SIM' and 'OTP received by the fraudster' is SIM swap.

Liability, reporting and safe digital lending

Who bears an unauthorised electronic loss was set by RBI's circular of July 2017, now carried as Section D of the 2025 Responsible Business Conduct Directions for commercial banks; this is the position for electronic transactions up to 31 December 2026. If the fault is the bank's (contributory fraud, negligence or deficiency), the customer's liability is zero, reported or not. If a third party breaches the system and the fault lies with neither bank nor customer, liability is zero when the customer reports within three working days of the bank's communication; for four to seven working days it is the lower of the transaction value or a cap (₹5,000 for a basic savings account, ₹10,000 for most other savings accounts and small business accounts, ₹25,000 for other current accounts and large-limit credit cards); beyond seven days it follows the bank's board-approved policy. If the loss came from the customer's own negligence, such as sharing an OTP, the customer bears it until reporting, and the bank bears losses after reporting. After notification the bank credits the amount within 10 working days, and the case is resolved within 90 days. Change coming: RBI's Directions of 24 June 2026 replace this regime, for commercial banks other than small finance, payments, regional rural and local area banks, for electronic transactions on or after 1 January 2027: zero liability where the bank is negligent; zero for a third-party breach reported within five calendar days of the event; a compensation scheme for small frauds up to ₹50,000. Read the question's date.

Worked example. A basic savings account holder sees a ₹40,000 debit she did not make, caused by a third-party breach, and reports it on the fifth working day after the bank's SMS. That falls in the four-to-seven-day band, so her liability is the lower of ₹40,000 and ₹5,000, that is ₹5,000; had she reported on day three, it would be nil.

Reporting. Act within the first hour or so, called the golden hour: tell the bank at once to block the card, UPI or account, then call the national helpline 1930 (24x7, under the Ministry of Home Affairs) or file at cybercrime.gov.in. The Citizen Financial Cyber Fraud Reporting and Management System, run under the Indian Cyber Crime Coordination Centre (I4C), lets police alert banks and wallets so that the money can be frozen before it is withdrawn. Complaints about the bank's handling can then go to the RBI Ombudsman as in the previous chapter.

Digital lending. RBI's Digital Lending Directions, 2025 (8 May 2025) require that a loan is disbursed into the borrower's own bank account (except for a specified end use, which may go to the end beneficiary) and that the borrower repays directly into the regulated lender's account; a lending service provider may not run pass-through or pool accounts, and its fees are paid by the lender, not charged separately to the borrower. A key fact statement with the annual percentage rate must be given before the contract, the board sets a cooling-off period of at least one day to exit by repaying principal and proportionate APR, data collection by lending apps needs explicit consent, and lenders must report their lending apps on RBI's CIMS portal, from which RBI publishes the list.

Key takeaways

  • RBI regulates under the PSS Act 2007; NPCI (2008) runs IMPS, UPI, RuPay, BBPS and AePS. RTGS is gross, individual and final, with a ₹2 lakh minimum (October 2026); NEFT runs in half-hourly batches.
  • UPI uses a VPA, device binding and the UPI PIN, and moves bank money in real time; the PIN is only for paying out, never for receiving.
  • Cards: issuer faces the customer, acquirer the merchant; AFA and tokenisation protect online payments, and since 1 October 2022 merchants cannot store card details.
  • BBPS is run by NBBL; AePS uses Aadhaar plus biometric via a business correspondent; e₹ is central-bank money in a pilot; the account aggregator moves data only with consent and does not store it.
  • For electronic transactions up to 31 December 2026, liability for an unauthorised third-party-breach loss is zero if reported within three working days of the bank's communication, capped for four to seven days, and per board policy after; a new regime applies from 1 January 2027.
  • After a fraud, tell the bank and call 1930 or use cybercrime.gov.in in the golden hour; digital loans must be disbursed to and repaid from the borrower's own account, with a key fact statement and a cooling-off period.

Practice questions (18)

Attempt each one before opening the answer. Every explanation names the tempting wrong option as well as the right one, because that is where marks are lost.

  1. As of October 2026, per RBI's FAQ, which statement about RTGS is correct?

    1. It runs only on bank working days and has a ceiling of ₹2 lakh per transfer
    2. It settles in half-hourly batches and has no minimum amount
    3. It has a minimum of ₹2 lakh and no upper cap, and runs round the clock
    4. It is run by NPCI and cannot be used for transfers above ₹5 lakh
    Show answer

    Answer: C — It has a minimum of ₹2 lakh and no upper cap, and runs round the clock

    RBI's FAQ gives RTGS a minimum of ₹2 lakh with no upper ceiling and 24x7 operation since 14 December 2020. Half-hourly batches describe NEFT, which has no RBI-set limit; RTGS is operated by RBI, not NPCI, and its ceiling is not ₹2 lakh.

  2. What does 'gross settlement' in RTGS mean?

    1. A transfer is first credited to the beneficiary and later debited from the remitter if funds exist
    2. All transfers of the day are added up and the net difference between banks is settled at the end of the day
    3. Transfers are collected into half-hourly batches and settled together at the end of each batch
    4. Each transfer is settled individually and immediately, without netting against other payments, and is final
    Show answer

    Answer: D — Each transfer is settled individually and immediately, without netting against other payments, and is final

    Gross means one-by-one, in real time, with no netting, in RBI's books, so a payment is final and irrevocable. Settling the net difference at day end is deferred net settlement, and half-hourly batches are how NEFT works.

  3. A person without a bank account wishes to remit cash to a beneficiary's account through NEFT. As per RBI's NEFT FAQ (as of October 2026), which statement is correct?

    1. Up to ₹50,000 a transaction, credited within two hours of the batch settlement
    2. Remittance is allowed up to ₹2 lakh, which is the minimum amount fixed for NEFT
    3. Cash remittance by such a person is not permitted through NEFT in any amount at all
    4. Remittance is allowed only on bank working days and for up to ₹10,000 a time
    Show answer

    Answer: A — Up to ₹50,000 a transaction, credited within two hours of the batch settlement

    RBI's FAQ caps cash remittance by a person without an account at ₹50,000 per transaction, with the beneficiary to be credited within two hours of the batch settlement. ₹2 lakh is the RTGS minimum and NEFT now runs 24x7 on all days.

  4. UPI began as a pilot in April 2016 with 21 member banks. Which organisation developed and operates it?

    1. UIDAI, under the Ministry of Electronics
    2. NPCI, under the regulatory oversight of RBI
    3. SEBI, as part of the securities market
    4. The Indian Banks' Association, as a banks' club
    Show answer

    Answer: B — NPCI, under the regulatory oversight of RBI

    UPI was developed by NPCI, which operates it under RBI's oversight. UIDAI issues Aadhaar and authenticates biometrics for AePS but has no role in UPI; SEBI regulates securities markets; the IBA only helped promote NPCI in its early days.

  5. A caller says ₹5,000 refund is ready and asks you to enter your UPI PIN on a collect request 'to receive' it. What actually happens if you enter the PIN?

    1. The ₹5,000 is credited to your account after a short verification delay
    2. The request is cancelled, because a collect request cannot be paid with the PIN
    3. Your bank refunds the ₹5,000 only after you also share the OTP with the caller
    4. You authorise ₹5,000 to be paid out of your account to the caller
    Show answer

    Answer: D — You authorise ₹5,000 to be paid out of your account to the caller

    The UPI PIN authorises money leaving your account; receiving never needs it. Approving a collect request with the PIN therefore pays the requester. Crediting after a delay is the lie told by the fraudster, and sharing an OTP would only worsen the loss.

  6. Assume UPI Lite limits of ₹1,000 a payment and ₹5,000 wallet balance (per PIB, August 2026). Meera's wallet is full. She pays ₹900, ₹750 and ₹600 from it. What is the most she can now load back into the wallet?

    1. ₹2,250, as the balance cannot pass ₹5,000
    2. ₹2,750, because that is the balance now left in the wallet
    3. ₹5,000, because a top-up resets the wallet to its full limit
    4. ₹1,000, because the per-payment cap limits every top-up
    Show answer

    Answer: A — ₹2,250, as the balance cannot pass ₹5,000

    Spent = 900 + 750 + 600 = ₹2,250, so ₹2,750 remains. The wallet cap is ₹5,000, so at most 5,000 - 2,750 = ₹2,250 can be added. ₹2,750 confuses the balance left with the room left, and the ₹1,000 per-payment cap applies to payments, not to loading.

  7. UPI 123PAY is designed for feature-phone users. Which of the following is NOT one of its payment approaches?

    1. Calling an interactive voice response (IVR) number to pay
    2. Scanning a QR with the phone's own camera
    3. Making a missed call to a designated number
    4. Using proximity sound-based payments from the phone
    Show answer

    Answer: B — Scanning a QR with the phone's own camera

    PIB lists IVR calls, an app-based approach, missed calls and proximity sound-based payments for 123PAY. Scanning a QR with a camera needs a smartphone, which is exactly what 123PAY avoids.

  8. Which card payment network was introduced in India by NPCI in 2012?

    1. Visa
    2. Mastercard
    3. RuPay
    4. American Express
    Show answer

    Answer: C — RuPay

    RuPay is the home-grown card network introduced through NPCI in 2012. Visa, Mastercard and American Express are international networks run by foreign companies.

  9. Under RBI's card tokenisation framework (card-on-file rules in force since 1 October 2022), which statement is correct?

    1. A token is tied to the card and merchant, and consent needs explicit AFA-validated approval
    2. A token works at every merchant, so one token is enough for all of a customer's online purchases
    3. Merchants may keep the card number if they do not store the CVV, since that alone is regarded as safe
    4. Consent is deemed given when the customer proceeds with a payment, so a pre-ticked box is acceptable
    Show answer

    Answer: A — A token is tied to the card and merchant, and consent needs explicit AFA-validated approval

    The token is tied to a particular card and merchant, and RBI requires explicit consent validated with an additional factor, not a default or pre-ticked box. Entities other than the issuer and the network may not store card-on-file data, whether or not the CVV is kept.

  10. Consider these statements. P: The issuer is the customer's bank that gave the card. Q: The acquirer is the merchant's bank that lets the shop accept cards. R: A credit card debits the cardholder's account balance at the moment of purchase. S: RuPay is a card network run by NPCI. Which statements are correct?

    1. P and R only
    2. P, Q and S only
    3. P, Q and R only
    4. Q, R and S only
    Show answer

    Answer: B — P, Q and S only

    P, Q and S are correct. R describes a debit card; a credit card extends a revolving credit line and the customer repays later. Any option containing R is therefore wrong.

  11. In AePS, a customer withdraws cash from a business correspondent's micro-ATM. Who authenticates the biometric, and who switches and settles the transaction?

    1. NPCI authenticates the biometric, and UIDAI switches and settles it
    2. RBI authenticates the biometric, and the business correspondent settles it
    3. UIDAI authenticates the biometric; NPCI switches, clears and settles
    4. The customer's bank authenticates it, and the card network settles it
    Show answer

    Answer: C — UIDAI authenticates the biometric; NPCI switches, clears and settles

    The biometric is authenticated by UIDAI, the Aadhaar authority; NPCI does the switching, clearing and settlement. Giving NPCI the authentication role swaps the two roles, which is the usual trap.

  12. The wholesale pilot of the digital rupee (e₹-W) began on 1 November 2022. For which use was it first run?

    1. Withdrawing cash from micro-ATMs run by business correspondents
    2. Paying small shop bills for customers in a closed retail group
    3. Paying electricity and water bills across every state
    4. Settling secondary-market transactions in government securities
    Show answer

    Answer: D — Settling secondary-market transactions in government securities

    The wholesale pilot began on 1 November 2022 for settling secondary-market trades in government securities. The retail pilot (e₹-R) began on 1 December 2022 in a closed group of customers and merchants, so shop payments describe the retail pilot.

  13. Which statement correctly distinguishes the e₹ from an ordinary UPI payment?

    1. UPI moves bank deposit money, while e₹ is itself central-bank money issued by RBI
    2. UPI creates new money inside the app while e₹ only records transfers between two bank accounts
    3. UPI is a private cryptocurrency while e₹ is an ordinary bank deposit balance
    4. UPI works only for merchants at present while e₹ works only between two individuals
    Show answer

    Answer: A — UPI moves bank deposit money, while e₹ is itself central-bank money issued by RBI

    A UPI payment instructs banks to move deposit balances between accounts. The e₹ is a digital token that represents legal tender and is issued by RBI itself. Neither is a private cryptocurrency, and UPI does not create money.

  14. Consider these statements on the account aggregator (AA). P: An AA is an NBFC licensed by RBI. Q: The AA stores a copy of the customer's bank statements for later use. R: A consent artefact records the data, purpose and period. S: The data passes from the information provider to the information user through the AA, which does not read it. Which are correct?

    1. P and Q only
    2. P, R and S only
    3. Q, R and S only
    4. P, Q and S only
    Show answer

    Answer: B — P, R and S only

    P, R and S are correct. Q is wrong: an AA moves data with consent but does not hold it at rest or use it for other purposes. Any option containing Q is therefore wrong.

  15. A fraudster uses forged documents to get a duplicate SIM issued in the victim's name and then receives the OTPs of the victim's bank transactions. This fraud is called

    1. vishing, because the criminal gets the victim to speak on a call
    2. skimming, because a device copies the details of the card
    3. SIM swap, as the criminal takes over the victim's number
    4. smishing, because the criminal sends a text with a malicious link
    Show answer

    Answer: C — SIM swap, as the criminal takes over the victim's number

    Taking over the victim's number through a duplicate SIM so as to intercept OTPs is SIM swap. Vishing is a voice call and smishing an SMS, in which the victim is tricked into revealing details; skimming copies card data from a machine.

  16. A basic savings account holder finds a ₹40,000 debit she did not make, caused by a breach elsewhere in the system, and reports it on the fifth working day after the bank's alert. Under RBI's July 2017 customer-liability framework, which applies to transactions up to 31 December 2026 (BSBDA cap ₹5,000), and taking the debit as occurring in 2026, her liability is

    1. zero, because the breach was not her fault and she reported in time
    2. ₹40,000, because she reported after the third working day passed
    3. ₹25,000, being the general cap that applies to every account type
    4. ₹5,000, the lower of the value and the cap for the band
    Show answer

    Answer: D — ₹5,000, the lower of the value and the cap for the band

    Reporting on day five falls in the four-to-seven-day band, so liability is the lower of ₹40,000 and the account's cap. For a BSBDA the cap is ₹5,000. Zero would apply only if she had reported within three working days, and ₹25,000 is the cap for other current accounts and large-limit cards.

  17. After losing money to a UPI fraud, what is the best immediate course of action?

    1. Tell the bank at once and call 1930 or use cybercrime.gov.in
    2. Wait for a month in case the money returns on its own, and then complain
    3. Approach the RBI Ombudsman first, since the police cannot act on online fraud
    4. Ask the fraudster to return the money by sending a fresh UPI request to his number
    Show answer

    Answer: A — Tell the bank at once and call 1930 or use cybercrime.gov.in

    Speed matters: the bank can block the instrument, and a report to 1930 or the portal lets police alert the banks to freeze the money. The Ombudsman is for service complaints against the bank, after it has had its chance to reply, not the first step.

  18. Under RBI's Digital Lending Directions, 2025, which arrangement for a personal loan taken through a lending app is consistent with the rules?

    1. The app's partner collects repayments in its own pool account and passes them to the lender
    2. The loan goes to the borrower's own account and repayment goes straight to the lender
    3. The borrower pays the app's service fee separately to the app and the lender pays nothing
    4. The borrower is given the key fact statement only after the loan agreement has been signed
    Show answer

    Answer: B — The loan goes to the borrower's own account and repayment goes straight to the lender

    Disbursal goes to the borrower's own account and repayment goes directly to the regulated lender's account; pass-through and pool accounts of the app are not allowed, the lender pays the app's fees, and the key fact statement must come before the contract is executed.