MobiKwik's app update let UPI payments clear on wrong PINs — ₹40 crore gone in 48 hours

On September 11 and 12, 2025, MobiKwik's UPI rails paid out on terms the banking system never would. A software update pushed earlier that month had quietly broken two basic checks in its wallet-linked payments: users could send amounts far above their wallet balance, and transactions cleared even when the PIN entered was wrong. In limited pockets of Haryana, registered merchants and users colluded to claim unauthorized settlements at scale — the FIR MobiKwik went on to lodge put the amount at ₹40 crore.

The company found out two days late. An internal audit flagged suspicious transactions dated September 11–12, and an employee reported the breach on September 13. MobiKwik lodged an FIR in Gurugram under the cheating and misappropriation sections of the Bharatiya Nyaya Sanhita; police arrested six men — five from Nuh, one from Palwal — identified around 2,500 beneficiaries, and froze ₹8 crore across bank accounts. MobiKwik recovered about ₹14 crore, leaving an estimated net impact of ₹26 crore per its exchange filing.

The glitch landed on the company's growth engine. MobiKwik had been selling investors on Pocket UPI — UPI payments routed through the MobiKwik wallet rather than a bank account — with gross merchandise value up 53% year on year in Q1 FY26 on rising UPI volume. Volume is the metric; limits are its anti-metric. The fraud hit the September-quarter books as a net loss of ₹28.6 crore, roughly eight times the ₹3.6 crore loss a year earlier, and the stock slipped on the disclosure.

₹40 crore siphoned in 48 hours; ₹14 crore recovered, net impact ₹26 crore; six arrested, ₹8 crore frozen, 2,500 beneficiaries traced

The release shipped without the two tests that matter most in payments: a wrong-PIN attempt and an over-balance send. Both passed on production rails.

Detection was post-hoc. Two days of anomalous settlement traffic from a few districts went unflagged in real time; an internal audit, not an alert, ended it.

The growth story raised the stakes: Pocket UPI's volume push made limits look like friction, and limits were exactly what failed.

Police suspected insider help in revealing the flaw — privileged knowledge of the update was never ring-fenced or monitored.

In payments, the negative paths are the product: a release that never tests wrong PINs and over-balance sends turns the growth engine into a drain. Rollback is a control, not a contingency.

MobiKwik filed for ₹40 crore, recovered ₹14 crore, and told exchanges the estimated net impact was ₹26 crore, with collection and legal efforts continuing. Six accused went to judicial custody; Nuh police publicly asked residents who received unexplained transfers on September 11–12 to come forward and return them. The loss helped turn Q2 FY26 into a ₹28.6 crore net loss. It was also the third fraud disclosure in MobiKwik's recent history — after a ₹19 crore fraud in 2017 and a ₹1.26 crore ex-employee fraud spanning August 2023 to September 2024 — a pattern investors now read together.