Companies operating UPI platforms are understood to have told the government in private meetings that the cost of securing the payments network is rising sharply, with emerging artificial intelligence (AI) systems adding a new layer of risk to fraud prevention and cybersecurity.
The firms are understood to have specifically flagged threats posed by Anthropic’s Mythos Preview, arguing that defending payment systems against increasingly capable AI tools will require greater investment, a concern they have cited as part of their broader pitch for allowing a merchant discount rate (MDR) on UPI transactions.
Industry insiders estimate that the total spends on security-related inputs account for over 20% of the total costs of running a UPI platform annually, which could rise sharply in deploying cutting-edge security software to prevent risks posed by AI systems like Mythos.
“Many of the UPI ecosystem participants have flagged to us that due to risks linked to systems like the Mythos Preview, which most Indian entities do not yet have access to, there is going to be an exceeding investment towards securing UPI platforms,” a senior government official said.
AI threats raise costs
Earlier this year, Finance Minister Nirmala Sitharaman held a high-level meeting with stakeholders from the financial sector to assess the risks posed by Mythos over concerns that the system’s capabilities could pose significant risks to India’s banking sector.
Anthropic’s Mythos Preview is a restricted-access frontier AI model with advanced cybersecurity capabilities, including the ability to discover previously unknown software vulnerabilities and chain them into complex attacks, raising concerns that similar systems could dramatically lower the cost and expertise needed to mount sophisticated cyberattacks.
The Payments Council of India, a lobby group consisting of all major UPI providers, in a statement had earlier said, “As transaction volumes continue to grow, sustained investment in security, resilience, innovation, fraud prevention and infrastructure will remain essential to ensure that UPI continues to serve consumers and businesses reliably for years to come”.
The founder of a major digital payments company, who was part of industry grouping that made a renewed pitch to the government to allow MDR on UPI, told The Indian Express that security threats from emerging AI systems is one of the biggest causes of concern for the ecosystem, with companies needing increasingly more money to deploy state of the art technology to deter them, and in hiring talented engineers, among other things.
“We were in conversation with a major technology company that runs payments in India and also has access to Mythos Preview, and even they had their fair bit of concerns about what the system was capable of,” this person said on condition of anonymity, and without revealing the name of the company. To be sure, Google, which runs a UPI platform in India, has access to Mythos Preview, under Anthropic’s Project Glasswing.
This founder also said that the security-related infrastructure costs for UPI are about 10-20 paisa per transaction, with investments needed in deploying AI tools, security software, and cloud services that are typically not made in India, and therefore have to be paid for in dollars. “And this cost doesn’t come down even as you scale, because the volume of transactions keeps getting bigger, and new threats keep emerging,” this person said.
Queries sent to the Payments Council of India, and companies that operate UPI platforms remained unanswered until publication.
MDR push gains ground
In July, UPI registered its highest-ever transaction volume of 2,366 crore transactions. At a security cost of 15 paise per transaction, the UPI ecosystem would have spent more than Rs 350 crore in that month alone to keep platforms secure. This would also peg the annual security-related costs at well over Rs 4,000 crore, supposing the monthly volumes remain the same throughout the year, though these numbers typically increase progressively.
The Indian Express had earlier reported that the cost of handling UPI and RuPay debit card transactions for banks and the wider payments industry could be as high as Rs 20,000 crore a year, meaning that security-related spends account for at least 20% of the total annual cost.
The Rs 20,000 crore figure includes costs for operating the mobile app, its development, and accompanying customer support. Then there are banks’ costs, which include authorisation, reconciliation, and settlement of transactions. And finally, there are costs linked to cybersecurity, Know-Your-Customer processes, cloud storage, disaster recovery, fraud detection, dispute handling, continuous network monitoring, and regulatory reporting.
Between 2021-22 to 2024-25, the Centre paid out Rs 8,730 crore under its UPI and RuPay debit card promotion scheme to network participants. However, this subsidy, as per a March report by the Standing Committee on Finance, accounted for “only 11% of the cost incurred by the digital payment industry”.
Industry insiders estimate that the total spends on security-related inputs account for over 20% of the total costs of running a UPI platform annually, which could rise sharply in deploying cutting-edge security software to prevent risks posed by AI systems like Mythos. (Image generated using AI) 
Share
