UPI Circle and Delegated Payments: New Fraud Attack Surfaces and Transaction Monitoring Protocols for Banks

UPI Circle offers two delegation models that differ by spending limits and approval steps. In August 2024, the Reserve Bank of India announced delegated payments in its Statement on Developmental and Regulatory Policies. This policy lets primary account holders authorize secondary users to pay from their account. The secondary user does not need a separate bank account.

NPCI set the operating framework on August 13, 2024, in an operating circular on UPI Circle. The framework outlines two models:

• •Full Delegation: The primary user grants secondary users power to make payments on their own up to fixed caps. The secondary user pays without the primary user entering a UPI PIN.
• •Partial Delegation: The secondary user starts a payment. The transfer clears only after the primary user approves it in real time using their primary UPI PIN.

Under Full Delegation, NPCI caps spending at ₹5,000 per payment and ₹15,000 per month for each secondary user. Partial Delegation has no ₹15,000 monthly cap because the account owner approves every payment. Instead, it follows standard bank daily UPI limits.

An account holder can link up to five secondary users. Linking a new user triggers a 24-hour cooling-off period. During this window, the secondary user can spend at most ₹5,000 in total.

In July 2025, NPCI updated rules to require Officially Valid Document logging for secondary users under Full Delegation, focusing on family and small business staff. In October 2025, NPCI extended Full Delegation to smartwatches, smart glasses, connected displays, and software profiles. These hardware profiles retain the ₹5,000 payment limit, ₹15,000 monthly cap, and cooling window while requiring physical gesture triggers. In September 2026, NPCI codified these requirements in Section 17 of its UPI Consolidated Circular.

Delegated payments rely on independent device binding, payment tagging, and instant alerts to protect the main account. Under the RBI Master Direction on Digital Payment Security Controls, payment apps must enforce multi-factor authentication, device binding, and SIM checks to prevent session cloning.

Secondary apps must maintain independent device binding and local app locks, requiring passcodes or biometrics. The secondary user never receives or enters the primary UPI PIN.

To track payments, NPCI requires payment providers to add Purpose Code "BH" to clearing files. This code separates UPI Circle payments from normal peer-to-peer and merchant flows in settlement data.

The system also sends real-time alerts. When a secondary user pays, the primary phone gets an instant text and app notice. The primary app provides an ongoing dashboard and a one-tap button to cut secondary links right away.

RBI rules also mandate Runtime Application Self-Protection. Apps must detect rooted devices, emulators, and screen-sharing tools, terminating sensitive payment sessions immediately upon detection.

Splitting the payer from the account owner creates four main fraud vectors across the payment flow.

1. Social Engineering of Secondary Users

Fraudsters target naive secondary users, such as children or elderly relatives, using fake gaming rewards, lottery scams, or phishing links. Under Full Delegation, the secondary user sends funds directly, draining balances up to pre-set caps without primary PIN approval.

2. Account Takeover and Rogue Delegation

Attackers who compromise a primary phone through SIM swaps or credential theft link an accomplice as a secondary user. Full Delegation creates a persistent exfiltration pipeline, letting fraudsters siphon funds without further primary OTP prompts.

3. Micro-Mule Rings and Layering

Criminal rings coerce or recruit account holders to link accomplice numbers under Full Delegation. By splitting illicit funds into multiple ₹5,000 payments across several circles, syndicates evade single-account velocity thresholds. For recruitment typologies, read our guide on mule account fraud detection.

4. Malware Hijacking of Secondary Devices

Secondary users often use unmanaged phones. Attackers trick users into installing malicious apps or screen-sharing tools, hijacking app sessions to execute Full Delegation transfers below alert limits.

Delegated payments complicate anti-money laundering controls by separating the spender from the verified customer. Under Chapter VI, Section 37 of the Reserve Bank of India 2025 KYC Directions for commercial banks, banks must monitor transactions against customer risk profiles.

When secondary users spend funds, the transaction initiator differs from the verified account holder. This complicates beneficial ownership checks and audit trails. Significant secondary spending can cause an account to drift from its baseline profile.

This creates friction during Suspicious Transaction Report filings. Monitoring engines map transactions solely to the primary customer's KYC profile. Compliance teams risk missing that an unverified secondary user drove the activity, creating evidential gaps when filing reports with the Financial Intelligence Unit – India.

Financial liability for unauthorized payments depends on the mandate granted by the account owner.

Under the Reserve Bank of India's customer protection circular, liability follows two rules:

• •Zero Liability: Customers pay nothing if fraud stems from bank errors or third-party breaches reported within three working days.
• •Limited Liability: Customers bear losses caused by their own neglect, like sharing codes, until they alert the bank.

Under Full Delegation, the primary user creates a valid payment mandate on bank rails. Consequently, banks treat transactions within approved limits as authorized by the primary user.

This creates dispute friction when a secondary device is compromised without primary customer negligence. If malware triggers payments up to the ₹5,000 limit, banks treat transfers as authorized under the mandate. The customer faces difficulty claiming zero liability without proving secondary endpoint compromise. Under Section 17 of the UPI Consolidated Circular, disputes must follow NPCI's Unified Dispute and Issue Resolution framework for automated timelines and compensation.

Protecting delegated payments requires banks to track both phones and screen national fraud registries.

Multi-Entity Context Intelligence

Monitoring engines cannot judge an account with one profile. Systems must track separate behavioral baselines for the primary user and each secondary user. Shifts in secondary transaction patterns should raise independent alerts.

Aggregate Circle Velocity Controls

Rules must track velocity across individual users and the entire circle. If multiple secondary users make payments near the ₹5,000 cap or the ₹15,000 monthly limit concurrently, systems should pause the circle and request primary PIN verification.

Device and Geolocation Discrepancy Checks

Banks must correlate telemetry from both devices. An abrupt physical distance between primary and secondary phones, or simultaneous payments from conflicting IP ranges, signals fraud.

Real-Time Screening with the I4C Suspect Registry

On September 10, 2024, the Ministry of Home Affairs launched the Central Suspect Registry under the Indian Cyber Crime Coordination Centre. It compiles suspect identifiers from the National Cybercrime Reporting Portal. Banks must check secondary phone numbers and UPI IDs against this database before approving links.

Through collaboration between the Indian Cyber Crime Coordination Centre and the Reserve Bank Innovation Hub, registry data feeds AI tools like MuleHunter.ai to spot micro-mules. For institutional details, read our report on institutional anti-mule infrastructure.

Secondary Device Health Checks

Apps must verify secondary device health. If an app detects an emulator, screen-sharing tools, or missing screen locks, it should block Full Delegation and demand primary PIN approval.

The practical implication of UPI Circle is that transaction monitoring must shift from single accounts to user networks.

Read together, the ₹5,000 payment cap, the ₹15,000 monthly limit, and Purpose Code "BH" mean criminal rings will not use one secondary user for large theft. Instead, syndicates spread micro-mule payments across multiple secondary links on recruited accounts. Fraud rules configured only for high-value single-account velocity thresholds will miss this activity.

For bank fraud teams, this suggests three operational steps:

• •First, risk teams should track payments carrying Purpose Code "BH" against total circle limits rather than single account ceilings.
• •Second, onboarding systems should check all secondary phone numbers against the I4C Central Suspect Registry before activating links.
• •Third, when secondary phone checks show poor device health, apps should switch Full Delegation to Partial Delegation, requiring primary PIN entry.

The likely next regulatory step is tighter document checks for secondary users and mandatory biometric steps on fast-moving circles. Teams that track multi-user behavior today will protect their customers while meeting regulatory standards.