Privacy-Aware AI-Based Fraud Detection and Prevention Framework for Secure UPI and Digital Banking Transactions in India

Counts differ because each database indexes a different set of publications. We treat OpenAlex as the canonical count; Google Scholar is not shown (no API, and crawling it violates its ToS).

The Unified Payments Interface (UPI) has made instant, low-friction payments a daily habit for hundreds of millions of people in India, and in doing so has created a large and fast-moving attack surface for fraud. Effective defence needs machine learning over rich behavioural, device and network signals, yet pooling such data conflicts with the privacy obligations placed on banks and payment service providers by India’s Digital Personal Data Protection Act, 2023 and by sectoral regulation. This paper proposes PRISM-UPI, a privacy-aware, five-layer framework for real-time fraud detection and prevention. The framework combines (i) privacy-by-design data minimisation and keyed pseudonymisation, (ii) behavioural, device and graph feature engineering, (iii) a tiered detection engine made up of a cost-sensitive stacking ensemble, a graph neural network for mule-account rings and an unsupervised detector for cold-start behaviour, (iv) cross-institution federated learning with secure aggregation and differentially private updates, and (v) a risk-based prevention layer that selects among allow, warn, step-up authentication, delay and block using an expected-cost rule, with SHAP-based explanations and audit trails. We formalise the threat model, specify the learning and privacy mechanisms, and define a reproducible evaluation protocol based on temporal splits, precision-oriented metrics and privacy–utility trade-off analysis. The paper is a design and methodology contribution: because real UPI transaction data is not publicly available, empirical results are not reported here, and the protocol is written so that institutions with data access can reproduce and complete it..