DoT's Financial Fraud Risk Indicator and Sanchar Saathi: How Banks Use Telecom Risk Signals

India's telecom security network blends public citizen portals with private institutional data feeds to fight fraud.

On March 4, 2024, the Department of Telecommunications launched the Digital Intelligence Platform. This private portal lets phone companies, police, and banks share live fraud data. On the same date, the government launched Chakshu on the Sanchar Saathi citizen portal. Chakshu lets citizens report scam calls, fake SMS alerts, and WhatsApp fraud, such as fake KYC warnings or power cut threats.

Sanchar Saathi hosts public citizen utilities like Chakshu for reporting fraud, TAFCOP (Telecom Analytics for Fraud management and Consumer Protection) for checking SIM cards registered in one's name, and CEIR (Central Equipment Identity Register) for blocking lost handsets. In contrast, the Digital Intelligence Platform is a closed network for verified institutions, hosting the Mobile Number Revocation List of disconnected or churned numbers. Processing customer mobile numbers across shared platforms operates under the Digital Personal Data Protection Act, 2023 purpose limitation standards.

To enforce action, the Reserve Bank of India released an enforceable circular on fraud prevention on January 17, 2025. The rule ordered banks, NBFCs, and payment firms to clean databases using the revocation list by March 31, 2025. Entities also had to list verified helpdesk numbers on Sanchar Saathi, moving service calls to 1600xx and sales calls to 140xx.

The risk indicator scores phone numbers using citizen scam reports, police complaints, and phone verification checks.

On May 22, 2025, the telecom department introduced the Financial Fraud Risk Indicator on the Digital Intelligence Platform to score phone numbers in real time. On June 30, 2025, the Reserve Bank of India issued a formal advisory to banks, advising commercial, payment, and small finance banks to integrate the indicator through secure APIs.

The system pulls data from four main sources: National Cybercrime Reporting Portal files run by the Indian Cyber Crime Coordination Centre, citizen reports from Chakshu, phone company disconnection logs, and bank fraud files.

The system places numbers into three risk tiers:

1. Medium Risk: Flags phone non-compliance, dormant numbers with sudden activity, or minor record flaws. Banks run extra identity checks rather than blocking transactions.
2. High Risk: Flags direct links to active cybercrime complaints on NCRP, forged identity papers, or known scam campaigns.
3. Very High Risk: Signals confirmed cybercrime linkage or extensive fraudulent communications, requiring immediate protective restrictions.

A DoT milestone announcement in September 2026 showed rapid adoption. Over 1,600 entities joined within 15 months of launch. The system saved ₹660 crore in its first six months and over ₹5,000 crore by September 2026. Stopping fraud at the gateway avoids slow post-fraud clawbacks and court orders.

Automated onboarding systems check phone revocation lists and risk scores to block dirty numbers before opening accounts.

When an applicant applies for an account, digital loan, or wallet, the lender checks their phone number against the Mobile Number Revocation List. As noted in technical implementation guidance from Signzy, onboarding stops if the number appears on the list. Telecom operators reassign disconnected numbers over time, creating takeover risks on recycled numbers that require manual review or rejection.

Lenders also query the risk indicator. If it returns High or Very High Risk, the firm runs Enhanced Due Diligence, requires biometric checks, or halts digital onboarding. This helps prevent fraudsters from activating mule accounts.

Regular database scrubbing against telecom revocation lists helps banks spot cut-off customer numbers and stop account takeovers.

Banks cannot rely only on onboarding checks. In daily account management, firms run batch scrubs and webhooks against the revocation list. These scans find existing customers whose phone numbers have been disconnected, surrendered, or revoked.

When a scrub flags an active customer's number, the bank takes three steps:

• •Temporary OTP Holds: The core banking engine pauses SMS one-time passwords to the number to stop access if the SIM was reassigned.
• •Transaction Restrictions: The platform stops outbound transfers on mobile and net banking apps.
• •Mandatory Re-KYC Workflows: The customer must do in-person checks or re-verify their profile to link an active number.

Continuous monitoring aligns with Chapter VI of the RBI KYC Directions for commercial banks. This chapter covers ongoing due diligence and periodic KYC updates. Tracking phone status keeps contact files valid and mitigates SIM-swap fraud risk.

Payment apps and banks scan payee phone numbers in real time to stop fraudulent transfers before funds settle.

Digital payments move in seconds, making fund recovery difficult. To stop losses, payment apps and remitting banks query the risk indicator before clearing transfers.

When a payment targets a Medium Risk number, the interface shows warning banners or applies a brief cooling-off pause to counter phishing scams.

If the payee number returns High or Very High Risk, banks apply stricter controls: demanding biometric verification, lowering payment limits, placing credit holds, or declining the transfer outright. To avoid wrongful financial exclusion of legitimate users on recycled numbers, automated restrictions require human review queues and transparent customer dispute channels.

Intercepting fraud before settlement avoids the operational friction of bank liens, police freezes, and court restitution.

Linking telecom status data with banking transaction analytics builds a strong defense against money mule rings.

The telecom department stack tracks phone events like SIM swaps, cut-offs, and citizen scam reports. But phone data alone cannot show how funds travel through bank accounts. A mule account may use a clean phone number while showing fast cash velocity or circular money flows.

To track banking risks, the Reserve Bank Innovation Hub built MuleHunter.AI to analyze payment networks and mule rings. In parallel, the RBI committee report on the Digital Payments Intelligence Platform urged setting up a national intelligence utility to share live fraud flags. For more context, see our guide on MuleHunter.AI and payment intelligence networks.

The two layers monitor different risks across the fraud cycle:

• •Telecom Layer: Uses operator logs, Chakshu reports, and cybercrime complaints to catch compromised phone identities, churned numbers, and spoofed communications.
• •Banking Layer: Uses core banking engines and payment gateways to track fund pooling, rapid cash depletion, and transaction velocity across account networks.

Pairing phone flags with banking data closes the blind spot of sleeper mule accounts. Sleeper accounts show normal banking velocity and avoid internal rules. Yet telecom data may show that the linked phone has active scam complaints. Combining both layers strengthens mule account detection across the account lifecycle.

Connecting telecom intelligence with financial controls shifts fraud defense from post-event recovery to real-time gateway prevention.

Read together, the rollout of the Digital Intelligence Platform and central bank advisories suggest three priorities for risk teams:

First, institutions should separate legal mandates from regulatory advisories. Cleaning databases against the Mobile Number Revocation List is a mandatory duty with an expired March 31, 2025 deadline. In contrast, integrating the Financial Fraud Risk Indicator is an active advisory. While pre-settlement checks are not yet formal Master Direction rules, high saved fraud values suggest this will become standard industry practice.

Second, automated systems need human oversight and fair dispute paths. High-risk indicators justify quick holds, but banks should keep clear appeal paths for customers. Declining transfers based only on phone scores can harm legitimate users on recycled numbers. Human review queues clear false alarms while keeping fraud defenses strong.

Third, sharing customer data across platforms must follow data privacy laws. Under the Digital Personal Data Protection Act, 2023, processing personal identifiers requires purpose limitation and strong security. Banks should ensure phone numbers shared with external APIs serve only fraud prevention and compliance goals.