CRED

Is CRED safe?

For paying credit card bills and making UPI payments, CRED is about as safe as the bigger Indian payment apps, and it publishes more security detail than most of them. Its UPI payments run through Axis Bank and Yes Bank and need your UPI PIN, and we found no regulator fine against the company. What you give up is privacy. Joining means a credit-bureau check, an optional feature reads your financial emails and SMS, and the app is built to sell you loans and offers. We score CRED 61/100, just below Google Pay (62) and above PhonePe (59).

CRED is run by Dreamplug Technologies in Bengaluru. It started in 2018 as a rewards app for paying card bills and now covers UPI, bill payments, a wallet, loans from partner lenders, insurance and vehicle services. The Week reported that it processed payments worth ₹8.5 lakh crore for 15 million users in the year to March 2025.

What data does CRED collect?

More than a payment app strictly needs, though less ad tracking than some rivals. Apple's privacy label shows no data used to track you across other companies' apps. It lists seven types linked to your identity: financial information, contact information, your contacts, user content, identifiers, usage data and diagnostics. Contact information is also used for CRED's own marketing.

The privacy policy, last updated on 1 October 2026, adds three things worth knowing:

• Credit check to join. You must consent to CRED pulling your credit information from a credit bureau during sign-up. The terms say CRED can limit your access if your score is below its threshold.
• Email and SMS reading. If you turn on CRED Protect and link an email account, CRED reads financial emails such as card and bank statements, insurance policies and bills, and can open password-protected statements with automated tools. With CRED Protect on WhatsApp it may also read SMS. The data is used for bill reminders and for "products and services ... curated and personalised for you".
• Sharing with lenders. As a loan service provider, CRED shares your data with partner banks and NBFCs for credit assessment, and with insurers if you buy cover.

CRED says it does not sell or lease personal data, uses app activity for promotions only with your consent, and keeps payment data in India under RBI rules. The Google Play form is more candid than many: it says CRED shares your name, email, phone number, address, user IDs, app interactions and payment information with other companies, though only for app functionality and analytics.

How secure is CRED?

This is CRED's strongest area. Its security page says it is certified to PCI DSS v4.0.1 at Level 1, ISO 27001:2022 and ISO 27701:2019, encrypts stored data with extra application-level encryption for sensitive fields, and has its systems tested by CERT-In empanelled auditors, including the UPI audits NPCI requires. Cards are tokenised under RBI rules, so CRED does not need to keep your full card number.

We found no confirmed breach of CRED users' data. The gap is outside testing. CRED asks researchers to report bugs to [email protected] and promises only to fix valid issues "in a reasonable time frame", with no reward; we found no CRED programme on HackerOne.

UPI scams and the age gap

CRED users face the same tricks as every UPI user. India recorded 12.64 lakh UPI fraud incidents worth ₹981 crore in 2024-25 across all apps, and ₹805 crore in the first eight months of 2025-26, the Finance Ministry told the Lok Sabha. NPCI barred person-to-person collect requests from 1 October 2025, which removed the old "enter your PIN to receive money" trick, but fake customer-care numbers, screen-sharing apps and QR "refunds" remain. A UPI payment is instant and final.

CRED's own rules are stricter than its store ratings. The terms say anyone who joined from 1 October 2023 must be at least 21, yet the App Store rates the app 13+ and Google Play 3+. A teenager who downloads it will hit the credit check, but the ratings do not tell parents what the app is for.

CRED's regulatory record

We found no fine or order from the Reserve Bank of India, NPCI or a consumer authority that names CRED or Dreamplug. In March 2026 the RBI authorised Dreamplug Paytech Solutions as a payment aggregator, a licence that lets it collect and settle payments for merchants. The CRED wallet is issued by an affiliate whose refund form on CRED's site carries the name Hip Bar; the RBI fined Hip Bar Private Limited ₹10.85 lakh in 2019 over prepaid instrument rules, before it was part of the CRED group. We treat that as context, not a mark against the app.

How to use CRED safely

1. Pay card bills a few days before the due date and check that the payment reaches your card statement.
2. Leave CRED Protect off unless you want the reminders; if you use it, link only the email account that receives statements.
3. Never enter your UPI PIN to receive money, and never share it or an OTP.
4. Treat loan offers in the app as a sales channel, and compare the annual rate with your bank's.
5. Contact CRED only from inside the app; it will not ask you to install a screen-sharing app.
6. Report fraud at once on 1930 and to your bank.

How we scored it

Security (70) is CRED's strongest factor after the regulatory record, for published PCI DSS and ISO certifications, encryption at rest and a clean breach record, held back by the lack of a paid bug bounty. Privacy (50) and scams (50) are the weakest: a credit check to join, optional email and SMS reading for offers, and the usual UPI fraud risk. Regulatory record (86) is the highest score, for a clean record, but stays below 90 because no regulator has publicly reviewed the app.