The Reserve Bank of India asked lenders to tighten monitoring of UPI collect requests that mimic Open Network for Digital Commerce merchant handles, warning that payment crime rings are staging fake festival discounts to harvest PINs.

What the circular says

In a Friday note to chief compliance officers, the RBI said illicit schememers send collect requests from handles such as "ONDC-DEAL" or "FEST-OFFER" that resemble legitimate seller IDs. Victims approve payments thinking they are accepting refunds or cashback, but the request debits their account.

Banks must flag repeat collect attempts above ₹2,000 to the same VPA within ten minutes and delay settlement by 30 minutes for new merchants onboarded after 1 September, the RBI said.

ONDC and NPCI response

ONDC said it does not issue consumer-facing VPAs and asked marketplaces to display verified seller badges. NPCI plans to publish a whitelist API so banking apps can show a green check for enrolled merchants.

Cyberabad police said this week they took law-enforcement action against four people accused in a similar illicit scheme, according to a local press note targeting Hyderabad jewellery shoppers; investigators said the gang used rented corporate VPAs.

What customers should do

The RBI repeated that collect requests should be treated like cash handovers: verify the merchant name, amount, and note field. Banks may temporarily block gaming and crypto MCCs on new VPAs, mirroring IDFC First's card controls.

Payment companies expect payment crime rates to spike between Dussehra and Diwali, when quick-commerce volumes jump. Lenders that ignore the circular risk supervisory letters after the holiday season, compliance officers said.

Issuer playbooks

Large private banks told InfoHandle Network they will push in-app banners when a collect request arrives from a VPA created within the past 48 hours. Smaller cooperative banks lack the same real-time scoring, which is why the RBI asked them to route high-value collects through manual review queues until 15 November.

Payment aggregators must also register seller categories with NPCI before onboarding marketplace sub-merchants. Several wallets missed the 1 October deadline and have been barred from signing new sellers until they file updated risk assessments.

Customer education

Consumer affairs ministries in Gujarat and Maharashtra plan joint IVR campaigns in Gujarati and Marathi, repeating that legitimate refunds arrive as credit entries, not collect approvals. Telecom operators agreed to block SMS short codes that include the string "ONDC" without a registered entity header.

Banking ombudsman offices said complaint categories for "unauthorised UPI debit" typically spike 40% between Dussehra and Diwali. Documenting the merchant VPA and note field before disputing a transaction remains the fastest path to provisional credit, ombudsman staff said.

Context for readers

Market participants said the development fits a broader pattern of festive-season positioning across Indian assets, even as global rate paths stay uncertain. Local regulators have urged transparency in customer communications, and several industry groups plan briefings next week.

Analysts cautioned that one session does not reset the trend, pointing to derivative positioning and currency moves as nearer-term drivers. Still, domestic institutions appear willing to support names with clear earnings visibility through the holiday calendar.

Looking ahead

Next week's data calendar includes macro prints and corporate updates that could confirm or challenge Friday's move. Investors said they will watch foreign flows, especially after recent volatility in heavyweight financials.

For households, the practical impact may show up in product pricing, credit terms, or service availability rather than headlines alone. Officials have not announced additional measures, but desks are monitoring any follow-up circulars.