MobiKwik

Is MobiKwik safe?

MobiKwik is usable for UPI and small wallet payments, but it carries more risk than the bigger Indian payment apps. Two security events stand out. In September 2025 a software update let payments go through without enough balance or with a wrong UPI PIN, and in 2021 a seller claimed to hold data on about 99 million of its users, a claim MobiKwik denied and the Reserve Bank of India (RBI) never publicly resolved. The app also shares data for advertising. We score it 50/100, below Paytm (53) and PhonePe (59).

MobiKwik is run by One MobiKwik Systems Limited in Gurugram, a company listed on India's stock exchanges. Its app combines UPI, its own prepaid wallet, personal loans from partner lenders, bill payments, deposits and digital gold. The Play Store listing claims more than 18.6 crore users.

What happened in September 2025?

On 11 and 12 September 2025, a software update appears to have switched off key checks. According to Business Today, the system accepted nearly 5 lakh transactions even when a wallet or bank account lacked the balance or the UPI PIN entered was wrong. Some merchants and users in Haryana used the flaw to move money to their own accounts. MobiKwik found the problem in an internal audit, filed a police complaint for about ₹40 crore and told the stock exchanges it had recovered about ₹14 crore. Gurugram police arrested six people and froze accounts linked to about 2,500 recipients.

The losses fell on MobiKwik, not on customers' accounts, and the company says no staff were involved. For users, the lesson is that the PIN check, the main safeguard in any UPI app, failed for two days after one update. Business Today also recalled a 2017 incident in which MobiKwik lost ₹19 crore through mass transfers.

The 2021 data leak claim

In March 2021 a seller set up a dark-web site offering what it said was MobiKwik's database: about 99 million email addresses, phone numbers, passwords and addresses, and 40 million card records. MobiKwik denied any breach. It said a sample shared by CERT-In, India's cyber-security agency, did not belong to it, and that an unauthorised attempt on one of its systems on 1 March 2021 had been foiled. The RBI then ordered MobiKwik to commission a forensic audit by a CERT-In empanelled firm.

MobiKwik later said in its listing documents that its expert found no unauthorised access to the customer database during the period reviewed. The RBI said in October 2021, in reply to an information request, that it was still examining the report. We found no published conclusion. The leak remains an allegation, but an unresolved one, and that weighs on the security score.

What data does MobiKwik collect?

A lot, and some of it goes to advertising. Unlike the labels of Paytm, Google Pay and CRED, MobiKwik's Apple label shows data used to track you across other companies' apps, in its case usage data. It links financial information, location, contacts, contact details, user content and identifiers to you. Google Play says MobiKwik shares device IDs, app interactions, in-app search history and web browsing history with other companies for advertising and personalisation, and that the app contains ads.

The privacy policy adds that MobiKwik collects the list of apps installed on your phone, "even when the app is closed or not in use", reads SMS from business senders such as banks, and takes one-time location, camera and microphone access for loan KYC, with video-KYC calls recorded. It shares data with group companies, lending partners and service providers, and uses your contact details for promotional SMS, email and WhatsApp messages. Data is stored on servers in India.

Scams, loans and the wallet

MobiKwik users face the same UPI scams as everyone. India recorded 12.64 lakh UPI fraud incidents worth ₹981 crore in 2024-25 across all apps, the Finance Ministry told the Lok Sabha. NPCI ended person-to-person collect requests on 1 October 2025, but fake support numbers, screen-sharing apps and QR "refund" tricks continue.

Two features need care. Pocket UPI lets you pay from your wallet balance, and small payments can go through on fingerprint or face unlock without a PIN, so a strong phone lock matters. And the app puts loans front and centre, with annual rates of 12% to 45% listed on Google Play.

MobiKwik's regulatory record

The RBI fined MobiKwik ₹15 lakh in July 2019 for not following its rules for prepaid wallet issuers, and ₹1 crore in December 2021 for failing to meet the minimum net worth required to run a Bharat Bill Payment operating unit. The first is a small fine about the wallet; the second is a licensing condition, which we count only as context, as we do the 2021 audit order. We found no privacy fine.

How to use MobiKwik safely

1. Never enter your UPI PIN to receive money, and never share it or an OTP.
2. Keep the wallet balance low, since it is not a bank deposit.
3. Use a strong phone lock if you turn on Pocket UPI's biometric payments.
4. Deny installed-apps, location and SMS access you do not need in your phone's settings.
5. Compare loan offers with your bank before you accept one.
6. Report fraud at once on 1930 and to your bank.

How we scored it

Regulatory record (78) is MobiKwik's strongest factor: one small RBI fine about wallet rules, with the rest counted as context. Privacy (42) and security (48) are the weakest, for cross-app tracking and ad sharing, the September 2025 PIN failure and an unresolved 2021 leak claim. The overall score rounds 49.5 up to 50.