Indian banks saw reported text-message-based scams rise 146% between the second half of 2025 and the first half of 2026 compared with the same period a year earlier, based on BioCatch data from its customers in India. Mobile fraud sessions rose 67% overall, including an 86% increase on iOS devices and a 35% increase on Android devices, while web browser-based fraud sessions declined 10%. The data points to a shift in attacker focus toward mobile channels as India’s UPI, mobile banking, ecommerce and online investment usage continue to deepen.
The report also indicates that fraud attempts are becoming faster and higher value. Risky payment sessions doubled, median fraud session length fell by 32%, and the median transfer value per fraud session increased 1.7 times. The total value of attempted fraud payments rose 35%, while average call length declined 31%. Investigators detected more than 8.5 lakh mule accounts across more than 700 branches of multiple Indian banks in 2025. Cyber-fraud complaints in India reached Rs 22,496 crore in 2025, alongside 26.48 lakh mule cases, while Rs 9,055 crore was declined through the suspect registry.
BioCatch’s Director of Global Fraud Intelligence, Tom Peacock, said SMS scams are effective because they exploit trusted communication channels and prompt customers to act before questioning the message. He also said higher-value attempts combined with shorter calls and sessions show that attackers are becoming more efficient, using refined social engineering and automated techniques to move money before warning signs appear. Subhashish Bose, Global Advisory Director at BioCatch, pointed to increased collaboration among banks, the Reserve Bank of India, the Indian Cyber Crime Coordination Centre and law-enforcement agencies, and said behavioural intelligence can help banks move from point-in-time authentication to continuous assessment of user intent.
The figures sharpen the operational challenge facing Indian banks and payments firms. Fraud controls built around one-time authentication, device checks or transaction thresholds can miss scams where the customer is being actively manipulated into authorising the transaction. Shorter fraud sessions also reduce the intervention window for banks, payment processors and customer-support teams. In a mobile-first payments environment, fraud detection increasingly has to combine device intelligence, behavioural analytics, mule-account detection, transaction-risk scoring and customer-warning flows that are fast enough to interrupt live social-engineering attempts.
The rise in mule accounts adds another layer of complexity. Even when the initial scam occurs through SMS or assisted calling, the movement of funds depends on account networks that can receive, split and forward money quickly. Banks therefore need both front-end scam detection and back-end mule discovery across branches, accounts, devices and transaction patterns. The latest data reinforces that cyber-fraud prevention in Indian BFSI is no longer only a security function; it is now tied to product design, payments operations, customer experience, compliance reporting and real-time interbank coordination.
