NPCI and participating banks maintain dynamic blacklists of compromised devices, SIMs, virtual payment addresses, merchant IDs, and UPI handles. Transactions involving them trigger automatic rejections or escalations, preventing misuse by known bad actors. Watchlists update in real time via an integrated risk feed.
