SECURITY BRIEFING Rapido® InfraTel LLP · Heuristic Anti-Phishing Architecture
📞 +91-9327000022 ⚡ 100% Free Utility
📱 Download App
SECURITY SPECIFICATION

Client-Side AI Heuristic Threat Detection Shield

How Rapido®Pay intercepts malicious QR codes, detects social engineering phishing attempts, and safeguards users before payment PIN authentication.

1. The Threat Landscape in Modern QR Payments

With over 14 billion monthly UPI transactions in India, malicious actors frequently deploy deceptive QR stickers in retail stores or send phishing QRs over messaging channels. Common attack vectors include:

  • Fake Lottery / Cash Reward QRs: Deceptive prompts promising cashback but executing a debit payment intent.
  • Tampered Merchant QR Overlays: Attackers pasting private peer-to-peer (P2P) personal VPAs over authentic merchant QR stands.
  • Typo-Squatted Bank Handles: Impersonating official banking domains with confusing alphanumeric handles (e.g. @sbi-reward-claim instead of legitimate @sbi).

2. Five-Layer Heuristic Evaluation Pipeline

Evaluation Layer Inspection Criteria Risk Impact
1. Protocol Validation Verifies raw URI begins with valid upi://pay and adheres to NPCI specification standards. Fails invalid/malformed non-UPI URLs instantly.
2. Handle & Domain Verification Extracts the acquiring banking PSP handle (e.g., @bankhandle, @corporatebank, @retailpsp) against a certified registry of RBI-authorized banking handles. Flags unregistered or spoofed banking handles.
3. Lexical Threat Heuristics Scans payee name (pn), notes (tn), and VPA for social engineering keywords: lottery, prize, gift, refund, bonus, helpdesk. Assigns high threat penalty (+40 to +60 score).
4. MCC & Merchant Cross-Match Inspects Merchant Category Code (mc). If a merchant claims to be a supermarket (5411) but provides a personal P2P handle, a discrepancy is raised. Warns user of retail QR tampering.
5. Amount Anomalies Flags unexpected fixed amounts or zero-balance authorizations without valid invoice references (tr). Prompts user confirmation before intent hand-off.

3. Non-Custodial Zero-Liability Design

Rapido®Pay adheres strictly to a zero-custodial architecture:

  • No Funds Intermediation: Rapido®Pay never maintains an escrow account, nodal account, or wallet balance.
  • Zero Access to Credentials: The app never requests, captures, or transmits your UPI PIN, MPIN, or bank account password.
  • Direct Bank Settlement: Payment is authenticated exclusively within the user's selected official UPI banking application and settled through the NPCI Unified Payments switch.

Audited & Logged via Cloud Firestore

High-risk threat incidents are securely logged with anonymized transaction identifiers to generate real-time retail threat intelligence across India.

Review Disclaimers