Yes Bank told payment aggregators and its own mobile banking teams to tighten beneficiary name-matching rules on inbound UPI collect requests after a mid-September fraud wave in which customers approved payments to handles that displayed familiar shop names while routing money to unrelated account titles at other banks.
What broke in the collect flow
UPI collect lets a merchant or scammer send a pull request to a payer’s app. The payer sees a requested amount and a beneficiary label, but the underlying account name registered with the bank can differ when fraudsters register deceptive virtual payment addresses. Yes Bank’s risk unit said hundreds of flagged cases in the past ten days involved labels mimicking jewellers, tuition centers, and festival stall vendors while settling into personal savings accounts opened days earlier.
InfoHandle reviewed anonymized case summaries the bank shared with partner wallets: in most instances customers clicked approve because the on-screen merchant name matched a WhatsApp invoice, not because they verified the bank’s secondary name field that some apps hide below the fold.
What Yes Bank changed
Effective Friday, the bank requires a fuzzy match score between the collect request’s display string and the beneficiary’s KYC account name before auto-approval paths unlock. Low scores trigger an interstitial that forces manual confirmation and shows both strings side by side. Business accounts with verified legal names receive slightly looser thresholds, but sole proprietorships that recently changed trade names must re-upload GST-linked proofs.
Yes Bank also slowed high-value collect approvals during late-night hours when scam call centers operate, mirroring controls other private banks adopted after RBI’s recurring digital payment fraud advisories.
Who is liable
Legal liability still turns on customer authorization, but banking ombudsman rulings in prior UPI disputes have split refunds when banks failed to show adequate friction for mismatched names. Yes Bank executives told partner fintechs that the new rules aim to reduce those reversals without blocking legitimate festival collections where trade names differ slightly from PAN records.
NPCI maintains the central switch and publishes fraud awareness material, yet individual member banks set risk thresholds on collect authentication. Yes Bank’s move may push wallets to harmonize UI so the legal account name is never collapsed.
What police and CERT tracks
Mumbai and Bengaluru cyber cells said they are tracing mule accounts fed by the collect wave, but mule recruitment via Telegram channels is diffuse. No arrest totals are confirmed. CERT-In has not issued a sector-wide alert specific to collect spoofing, treating it as a social-engineering spike rather than a protocol flaw.
Customers who realize a mistake within minutes still depend on beneficiary banks freezing mule inflows—a step that fails when funds are instantly forwarded across multiple wallets.
Merchant and wallet response
Large wallets told InfoHandle they will surface Yes Bank’s mismatch warnings inside their own skins and pause recurring collect templates until name verification APIs refresh. Kirana associations asked for a whitelist model where neighborhood vendors register display names once; Yes Bank said whitelisting is under pilot for cooperative societies but not yet for one-off festival stalls.
What customers should verify
Banking regulators repeat that payers must confirm the account holder name shown by their app, not just the invoice sender on chat apps. Yes Bank added optional SMS echoes that spell out the legal beneficiary name for any collect above five thousand rupees.
The bank declined to quantify losses from the September wave, citing ongoing investigations shared with NPCI’s fraud monitoring cell. For now the fix is friction: slower taps, clearer names, and fewer assumptions that a familiar display string means a familiar bank account.
Regulatory context
RBI’s recurring consumer awareness campaigns already tell payers to treat collect requests like cheques—read the name, not the memo. Yes Bank’s technical change gives those campaigns teeth inside its own stack. Other member banks watching the pilot may copy the fuzzy-match interstitial before Diwali if chargeback ratios climb.
Payment aggregators integrating Yes Bank rails must ship updated SDK prompts by next week or face certification holds on new merchant onboarding, according to a circular seen by InfoHandle.
