India’s fraud battle moves upstream as account logins overtake payments as the key target

Suspected fraud is increasingly appearing at account access and creation stages, prompting businesses to strengthen identity, device and behavioural checks before money changes hands.

India’s digital fraud problem is changing shape, with criminals increasingly targeting identity rather than waiting for a payment to be made. Figures cited by TransUnion INDAS show that India’s suspected digital fraud rate stood at 7.1% in 2025, down from 13.1% a year earlier, but still almost twice the global average of 3.8%. The research suggests the threat is moving earlier in the customer journey, into account opening, login and recovery, where compromised credentials and synthetic identities can be used to establish control before a transaction even occurs.

That shift is especially visible at the login stage. TransUnion said suspected fraud was highest during account access in India at 3.9% in 2025, followed by account creation at 3.1% and financial transactions at 1.2%. In other words, the riskiest moments are often not the ones where money changes hands, but the earlier steps that determine whether the person behind the screen is genuine. The company’s data also indicates that 59% of Indian consumers said they were targeted by digital fraud in 2025, underscoring how widespread hostile activity has become.

The pattern is not limited to India. Global data cited by TransUnion found that account creation was the most vulnerable stage overall, with 8.3% of attempted digital interactions suspected to be fraudulent. That finding reinforces the case for continuous monitoring across the full customer lifecycle, rather than relying on fraud checks only at payment. Businesses that look only at transaction amounts, locations or spending behaviour may miss the warning signs that appear much earlier, when attackers are first trying to take over an account or establish a false identity.

TransUnion’s research also points to a broader industry challenge: fraud controls work best when identity, device and behaviour are assessed together. Identity data can indicate whether a user appears legitimate, device intelligence can reveal suspicious equipment or access patterns, and behavioural analysis can show whether an interaction matches previous activity. Used together, these signals can help companies distinguish between a genuine customer on a familiar device and an attacker using stolen credentials or a fabricated profile. But the same systems must be tuned carefully to avoid false positives that frustrate legitimate users.

The implications go well beyond security teams. TransUnion said 67% of Indian consumers considered confidence in the security of their personal data very important when choosing where to transact online, showing how closely trust is tied to commercial success. That makes data governance a business issue as much as a technical one. Companies need clear limits on how data is collected and used, strong access controls and transparent processes so that customers understand how their information supports both security and service delivery.

Impersonation scams add another layer of risk. Phishing, smishing and vishing campaigns continue to exploit the credibility of banks, retailers and service providers, often persuading victims to reveal credentials or verification codes. TransUnion argues that businesses must do more to make genuine communications easier to recognise, including verified identities, trusted caller identification and secure channels for account notifications. The message for companies is straightforward: digital trust now depends on spotting identity fraud early, verifying communications clearly and applying stronger controls without turning every interaction into an obstacle course.