India's banks are moving from rule-based alerts to shared, AI-driven, real-time fraud prevention, led by RBI and NPCI infrastructure. The evidence suggests this is starting to work for digital payment fraud, while large loan frauds and AI-enabled scams remain the main gaps.
TL;DR
- Fraud is shifting from cards to scams that rely on mule accounts. RBI-reported digital-payment frauds fell to 293 cases (₹29 crore) in FY26, but citizens reported ₹22,495 crore of cyber-fraud losses in 2025.
- Ecosystem AI is now the main defence: MuleHunter.AI (live in 26 banks), NPCI's federated risk scores and DPIP (live since 1 September 2026). Axis Bank (June 2026) reports 40% fewer retail digital frauds in FY26 than in FY25.
- Governance lags adoption. RBI's FREE-AI report found that of 127 entities using AI, only 15% use interpretation tools such as SHAP or LIME, and the DPDP Act's main obligations take effect in May 2027.
1. Fraud Detection (Primary Focus)
The threat in numbers
- Bank frauds: RBI's Annual Report 2025-26 records 10,114 bank frauds worth ₹48,021 crore, against 23,722 cases worth ₹32,803 crore in FY25.
- Most of the value is in loan (advances) fraud: ₹40,774 crore, or 84.9%.
- The total includes ₹30,199 crore of older cases reclassified after a Supreme Court judgment.
- Card, internet and digital frauds fell to 293 cases from 13,332. These figures cover only frauds of ₹1 lakh or more.
- UPI fraud: Losses were ₹1,087 crore in FY24, ₹981 crore in FY25 (12.64 lakh incidents), and ₹805 crore in FY26 up to November (Lok Sabha, December 2025). Losses are falling while transaction volumes grow about 32% a year.
- Cyber fraud (I4C): The National Cyber Crime Reporting Portal logged 24.02 lakh financial-fraud complaints in 2025. By June 2026, I4C reported ₹11,158 crore saved through its fraud-reporting system (CFCFRMS).
How the AI works
- Mule detection: MuleHunter.AI, built by the Reserve Bank Innovation Hub (RBIH), is a supervised machine-learning model trained on 19 patterns of mule-account behaviour.
- It was live in 26 banks by March 2026, according to a Lok Sabha reply.
- RBI Chief General Manager Suvendu Pati said in August 2025 that Canara Bank had reached 95% accuracy in detecting mule accounts.
- A May 2026 agreement between I4C and RBIH feeds police crime data into the model.
- Network risk scoring: NPCI runs a "federated" model that combines banks' own customer risk scores with NPCI's transaction and device profiling. Only scores are shared, not raw data, and NPCI gives banks real-time fraud scores free of charge.
- Shared intelligence (DPIP): The Digital Payments Intelligence Platform's Smart Registry went live with eight banks on 1 September 2026.
- It checks new customer onboarding, profile changes and beneficiary additions.
- Another 25 banks and the top 15 payment aggregators are due to join, covering about 80% of payment volume.
- Phase 2 will score individual transactions in real time before they complete.
- Bank deployments:
- Axis Bank uses real-time risk scoring, behavioural anomaly detection and fraud-network analytics. In June 2026 it reported 40% fewer fraud incidents across retail mobile banking, internet banking and shopping transactions in FY26 than in FY25, and fraud prevention up 4.5 times.
- Kotak Mahindra Bank says its machine-learning anomaly detection allows action on an account "often within minutes".
- HDFC Bank confirmed in early July 2026 (as reported by StartupFeed) an in-house real-time fraud engine, built by 150–200 engineers at its Gurugram tech centre, that scores transactions in microseconds. It sits alongside the bank's "Neev" generative-AI platform.
- SBI uses AI in fraud risk management and in its security operations centre.
Interpretation: Single-bank models cannot stop mule accounts that hop between banks. Cross-bank systems such as MuleHunter, DPIP and NPCI's federated scores are the real step forward.
2. Other Retail Applications (Brief)
- Customer service: Chatbots include SBI's SIA (designed for 10,000 queries per second), HDFC's EVA, ICICI's iPal and Kotak's Keya. HDFC reportedly resolves about 64–65% of interactions through bots.
- Credit: The Account Aggregator framework enabled ₹3.82 lakh crore of loans in FY26, 8.4% of retail and MSME lending by value. SBI underwrote about ₹1 trillion of MSME loans using AI.
- KYC, anti-money-laundering and collections: Banks use video KYC with liveness checks and machine-learning transaction screening. ICICI reports collecting over 40% of early defaults through machine-learning voice bots and SMS.
- Generative AI: Axis is scaling AI across operations and cut more than 3,100 staff in FY26.
3. Challenges and Regulation
- Governance (FREE-AI): RBI's FREE-AI report (August 2025) sets out 7 "Sutras" (principles) and 26 recommendations, including Board-approved AI policies, AI disclosures and incident reporting. In its survey, only 20.8% of 612 regulated entities used AI, and only 35% of those tested for bias. The recommendations are not yet binding.
- Privacy: The DPDP Rules were notified in November 2025, with full compliance due by May 2027. This will constrain how banks share data for fraud detection.
- Deepfakes: Business Standard (June 2026), quoting an unnamed industry source, reported that loan applications using deepfaked video KYC were processed and underwritten, causing a ₹15–20 crore fraud at one NBFC (non-bank lender).
- False positives and explainability: Wrongly frozen accounts harm genuine customers.
4. Outlook and Recommendations
Expect real-time, cross-bank transaction scoring through DPIP and NPCI to become standard during 2027. Banks should:
- connect to DPIP and MuleHunter early;
- add behavioural and device signals to video KYC;
- adopt FREE-AI governance before it becomes mandatory;
- report fraud outcomes transparently.
Key data caveats:
- Several bank figures are self-reported.
- MuleHunter adopter lists are not public.
- Fraud data from RBI, NPCI and I4C use different definitions and should not be summed.