Why growing trust in digital payments may be leaving Indians more exposed to cybercrime

Across India, the hum of digital payments now underpins daily commerce — from a roadside tea stall where a QR code replaces the cash box, to payments made to vegetable vendors, auto drivers and doctors. A scan, a password and a confirming beep have come to define routine transactions. But a new analysis suggests that the very trust fuelling this surge may also be increasing Indians’ exposure to online fraud.

Digital payments dominate daily life

Unified Payments Interface (UPI) sits at the centre of this transformation. In FY 2025–26, UPI processed more than 24,000 crore transactions, with values crossing ₹314 lakh crore. With about 70% of India’s population now connected to the internet, the country is one of the world’s most dynamic markets for digital services — and, increasingly, an attractive target for cybercriminals.

According to the Status of Policing in India Report (SPIR) 2026, digital payments are a daily habit for a large segment of users. Nearly half (49%) of respondents said they use UPI apps every day, while another 24% use them once or twice a week. UPI was also the most frequently used online payment method overall, with almost half (48%) saying they use it “many times”, ahead of cards, wallets and NEFT/RTGS.

High usage breeds high trust

With usage has come confidence. UPI garnered the highest levels of trust among payment methods, with a third of respondents (34%) calling it “very safe” and two in five (41%) considering it “somewhat safe” — meaning three in four users view it as safe overall. Card payments ranked next, with about two in three (65%) deeming them safe (28% “very safe” and 37% “somewhat safe”), followed by wallet-based apps and mobile banking apps.

Aggregating all online banking modes, a majority of respondents considered them safe, with 23% describing them as “very safe” and 40% as “somewhat safe.” On the surface, this looks like a success story: a widely used system that people trust, and that largely works as intended.

The trust paradox: confidence amid risky behaviour

SPIR 2026 also examined online behaviours that indicate vulnerability to cybercrime — such as opening links from unverified senders, downloading unknown files, or sharing one-time passwords (OTPs) with strangers. When these risk indicators were set against perceptions of safety, a striking pattern emerged: those most prone to unsafe online practices were also the most confident about online banking.

Among highly vulnerable users, about half (49%) described online banking modes as “very safe” and another 39% as “somewhat safe.” By contrast, among those with moderate to no vulnerability, only about a fifth, on average, considered online banking “very safe.”

More trust, more use — and a greater chance of victimisation

The report further connects perception to experience. Those who viewed online banking modes as “very safe” were more likely to have been victims of cybercrime in the past two to three years. Among those who reported being victims, 28% considered online banking “very safe,” compared with 14% who considered it “very unsafe.” As perceptions of safety decreased, so did the likelihood of having been victimised.

Usage trends tell a similar story. Individuals who use UPI “many times” were more likely to have experienced cybercrime in the last two to three years than those who never use it. Together, the findings suggest that growing familiarity and confidence in digital transactions may, paradoxically, be making some users less cautious — at precisely the moment cybercriminals are becoming more organised and inventive.

An industrialised fraud economy

The report describes a professionalised fraud ecosystem. A cybercrime expert interviewed for SPIR 2026 detailed a shadow supply chain that sells ready-made “kits” to fraudsters — bundles that can include pre-activated SIM cards, bank accounts and mobile phones. For an initial outlay of ₹10,000–20,000, the report notes, criminals can mount scams capable of draining victims’ life savings — often tens of lakhs or even crores — while remaining largely untraceable.

Victim interviews highlighted a range of tactics. Scammers have built convincing investment or betting applications to lure users into parting with money or personal information. Others have staged elaborate threats and hoaxes, at times holding victims under “digital arrest” for days — isolating them and manipulating them into disclosures under pressure. The sophistication of these ploys, and the way they exploit trust in familiar digital platforms, make them especially effective.

Users drawn in as unwitting accomplices

The deception extends beyond direct victims. Two individuals interviewed for the report, both accused of participating in cybercrime, said they had lent their bank accounts to fraudsters who ultimately deceived them — placing them squarely in the middle of criminal operations they claimed not to understand. According to the report, cybercriminals not only exploit gaps in the financial system, they also recruit ordinary users as expendable intermediaries who are most likely to be caught, while the masterminds remain out of reach.

What the findings suggest

SPIR 2026 points to an uneasy paradox: the more people use digital payments, the more they trust them — and, in many cases, the more likely they are to fall prey to cybercrime. That rising risk does not stem from digital payments alone, the report suggests, but from the convergence of high trust, habitual use and an adversary that has refined its tools and tactics to exploit human psychology.

Why it matters

India’s rapid embrace of digital payments is a major economic and social milestone, reducing friction in everyday transactions and expanding financial inclusion. But the SPIR 2026 findings underscore the need for sustained user education, stronger deterrence against organised fraud networks and continued hardening of the broader digital payments ecosystem. As the country’s digital economy deepens, closing the gap between trust and safe practices will be critical to protecting users — and to safeguarding confidence in systems that millions rely on every day.