3 weeks ago
UPI platforms flag rising security costs amid AI threats
UPI is a digital payment system that lets people in India send and receive money instantly with their phones.
The companies that run UPI told the government that keeping the system safe is getting much more expensive.
They are worried about new, very smart computer programs called AI that could be used by hackers.
One of these programs, called Mythos Preview, is so clever that it can find hidden weaknesses in computer systems and turn them into attacks.
Because of this danger, payment companies have to buy expensive security software and hire skilled engineers.
Right now, security costs make up more than one-fifth of everything it costs to run UPI.
In July, people made a record 2,366 crore UPI payments in just one month, which makes the security bill even bigger.
The payment companies are asking the government for permission to charge a small fee, called MDR, to help pay for all this security.
The government is still deciding what to do, and many questions have not yet been answered.
UPI platform operators told the government in private meetings that the cost of securing the payments network is rising sharply amid emerging AI threats.
Companies flagged risks from Anthropic's Mythos Preview, a restricted-access AI model that can discover software vulnerabilities and chain them into complex attacks.
Security-related spending accounts for over 20% of annual UPI platform running costs, estimated at well over Rs 4,000 crore a year.
UPI recorded its highest-ever monthly transaction volume of 2,366 crore transactions in July.
The industry is renewing its pitch to the government to allow a merchant discount rate (MDR) on UPI transactions to fund security investment.
- Who
- UPI platform operators and the Payments Council of India, plus Finance Minister Nirmala Sitharaman, who held a meeting on risks from Anthropic's Mythos Preview.
- What
- Companies flagged sharply rising cybersecurity costs driven by AI threats and renewed their push for a merchant discount rate (MDR) on UPI transactions.
- Where
- India.
- When
- Current, reported after UPI's record July volume of 2,366 crore transactions; the Finance Minister's Mythos risk meeting was held earlier this year.
- Why
- Emerging AI systems such as Mythos Preview are expected to lower the cost and expertise needed for sophisticated cyberattacks, requiring heavier investment in security.
Payments Industry (MDR proponents)
Current no-MDR policy stance
Merchant discount rate (MDR) on UPI
Payments Industry (MDR proponents)
The industry argues MDR should be allowed because AI-driven security threats require far greater investment, with security costs already over 20% of UPI platform running costs.
Current no-MDR policy stance
UPI currently operates without MDR; instead the government has paid promotion subsidies of Rs 8,730 crore since 2021-22, which the industry says covers only 11% of its costs.
Key facts
- AI model flagged
- Anthropic's Mythos Preview (restricted-access)
- Share of security in UPI operating costs
- Over 20%
- Estimated annual security spend
- Well over Rs 4,000 crore
- Total annual UPI/RuPay handling cost
- Up to Rs 20,000 crore
- Security cost per transaction
- 10-20 paise
- Record UPI volume (July)
- 2,366 crore transactions
- Government promotion payouts (2021-22 to 2024-25)
- Rs 8,730 crore (11% of industry cost)
Quotes
Senior government official
Government representative speaking in private meetings with UPI platforms
“Many of the UPI ecosystem participants have flagged to us that due to risks linked to systems like the Mythos Preview, which most Indian entities do not yet have access to, there is going to be an exceeding investment towards securing UPI platforms”
indianexpress.com
Founder of a major digital payments company (anonymous)
Executive of a leading UPI provider, speaking on condition of anonymity
“We were in conversation with a major technology company that runs payments in India and also has access to Mythos Preview, and even they had their fair bit of concerns about what the system was capable of”
indianexpress.com











