First, a story you've probably heard.
Your phone rings. Unknown number.
A calm, confident voice introduces himself as "Officer Sharma from the Cyber Crime Division."
He tells you your Aadhaar has been linked to suspicious transactions. Your account may be frozen in 30 minutes unless you verify your identity immediately. He sounds official. He knows your name. He knows your bank. He's in a hurry and crucially he makes you feel in a hurry too.
You panic. You transfer the money he asks for. And then he's gone.
This isn't a hypothetical. This is happening to thousands of Indians every single day. In 2025 alone, Indians lost Rs 22,930 crore to digital payment fraud. That's not a rounding error. That's larger than the annual budget of several Indian states.
And the reason these scams work so well? UPI is instant.
The problem with instant.
UPI is one of India's greatest achievements.
18 billion transactions in March 2026 alone. More daily transactions than Visa handles globally. Instant, free, available on a Rs 5,000 phone in a village in Jharkhand.
But instant has a dark side.
When a fraudster tricks you into sending money, that money moves in seconds before you realise what happened, before you can call your bank, before anyone can stop it. In cyber fraud cases, stolen funds often pass through numerous bank accounts within minutes before being withdrawn as cash, making recovery extremely difficult.
The RBI has been watching this number climb. And last week, it decided to act.
What the RBI is proposing.
On April 10, 2026, the Reserve Bank of India released a discussion paper titled "Exploring Safeguards in Digital Payments to Curb Frauds."
The headline proposal: a one-hour cooling-off period for transfers exceeding Rs 10,000.
Here's exactly how it would work. You send Rs 15,000 to someone via UPI. Your account gets debited immediately. The money leaves your account. But the recipient doesn't get credited right away. It sits in a holding window for up to one hour. During that hour, you can cancel the transaction if you realise something's wrong.
Merchant payments like scanning QR codes at shops or paying for groceries are likely to remain instant. So your chai-wala, your Swiggy order, your petrol pump, all untouched. Only person-to-person transfers above Rs 10,000 get the pause.
This is not a law yet. The RBI has invited public feedback until May 8, 2026, and will take a final call after reviewing responses.
Why Rs 10,000 specifically?
This is not a random number.
RBI data shows transactions above Rs 10,000 represent approximately 45% of fraud cases by volume but account for 98.5% of the total value lost to digital fraud.
Read that again. 98.5% of the money lost to fraud comes from transactions above Rs 10,000. The threshold is surgically chosen. Leave the small transactions alone. They're the backbone of everyday digital life. Target the window where the real financial damage happens.
There's more in the proposal.
The one-hour delay grabbed the headlines, but the RBI's discussion paper has three other proposals that are equally interesting.
A "kill switch." A universal button to instantly freeze all payments from your account, UPI, IMPS, net banking, in a single action. Suspect your phone was stolen? One tap and nothing can move from your account. Singapore already has this. Some Australian banks do too.
Trusted person approvals. For elderly or vulnerable users, large transactions may require a second sign-off from a designated trusted person, a family member or caretaker. A fraud safeguard that acknowledges not everyone using UPI is equally equipped to spot a scam.
Telecom-linked caller IDs. Calls from numbers starting with 1600xx or 1400xx will help users identify genuine or promotional calls, reducing fraud through fake phone calls. The "Officer Sharma" who calls you won't be able to fake a legitimate-looking number as easily.
The obvious objection.
But I need to send money fast. What if it's an emergency?
It's a fair point. And it's the tension at the heart of this proposal.
India's UPI system became the envy of the world precisely because it was instant. Other countries are actually studying India's model to copy it. India's proposed 60-minute hold is actually shorter than the UK's 72-hour window or Singapore's 12-hour model for high-risk actions. By global standards, India is still keeping things relatively fast.
And the RBI has been careful. Merchant payments stay instant. Small transfers below Rs 10,000 stay instant. The friction is targeted, not blanket.
The real question is whether one hour is a reasonable price to pay for protecting Rs 22,930 crore a year from fraudsters. Most people, thinking clearly, would say yes. The problem is that fraud victims aren't thinking clearly when they're being scammed. Which is exactly the point.
What this means for you right now.
Absolutely nothing yet. Until the RBI finalises guidelines after the May 8 feedback deadline, digital payments including UPI continue to function as usual.
But here's what you can do right now, regardless of what the RBI decides:
Slow down yourself. The reason these scams work is artificial urgency. "Act in 30 minutes or your account is frozen." No legitimate bank, government department, or institution will ever demand an immediate UPI transfer to protect your account. Ever. The moment someone creates urgency around a money transfer, that's your signal to stop.
Verify before you transfer. If someone calls you about your bank account, hang up and call your bank directly on the number printed on your card. Not the number the caller gives you.
Use UPI's own features. Most UPI apps already let you report fraud numbers, block contacts, and set transaction limits. Most people have never explored these settings.
The RBI's proposed pause button is a good idea. But the best pause button is the one in your own head.
The bigger picture.
India's UPI network processed 228 billion transactions worth nearly Rs 300 lakh crore in 2025, averaging 698 million transactions every single day. That scale is extraordinary. It also means the attack surface for fraudsters is extraordinary.
The RBI is essentially asking: at what point does pure speed become a liability? When instant means irreversible, and irreversible means the fraud victim has no recourse, is that a system we're proud of?
The one-hour delay is a proposal to add a little friction. Not to slow India down. To give honest people a fighting chance against dishonest ones.
Instant was a revolution. Smart might be the next one.
