MDR Charged on Zero-MDR UPI / RuPay Debit: The Most Common Leakage Pattern (2026 Regime Change)

Last updated: 17 September 2026 — Pattern #1 of the eight-pattern merchant-fee leakage taxonomy, restated for the 15 October 2026 UPI MDR regime change. Reflects the Income-tax Act 2025 framework live since 1 April 2026 (Section 393 sub-clauses + payment codes 1001-1092 replacing the legacy 194x sections).

Quick Reference

A finance controller running a per-network effective-rate audit on a UPI-heavy merchant after 15 October 2026 must run the check in bands. On UPI bank-account volume at or below ₹2,000 per transaction (about 95% of UPI P2M count by NPCI’s own figure) and on the full RuPay debit range, network MDR is still zero by statute — any positive “MDR” line against that base is Pattern #1 leakage in its original form. On UPI bank-account volume above ₹2,000, a 0.4% MDR (capped at ₹300 for transactions at or above ₹75,000) is now the notified expectation, effective 15 October 2026 — a positive MDR line in that band is expected, and the audit question becomes whether the rate matches the notified schedule, not whether the charge exists at all. For a business with two or three crore of monthly UPI volume, the recovery pool is still material but its composition has changed: pre-15-Oct, the entire UPI base was the recovery pool; post-15-Oct, the recovery pool is (a) the residual at-or-below ₹2,000 sub-band on bank-account UPI, (b) the entire RuPay debit and RuPay-credit-on-UPI cells, and (c) any material variance between the billed MDR and the notified 0.4% (or the ₹300 cap) in the above-₹2,000 sub-band. This article is Pattern #1 of the eight-pattern leakage taxonomy used across the merchant-fees cluster; it is the highest-frequency, highest-recovery class and the one most CFOs and controllers find first, and the detection logic below has been restated for the post-15-October regime.

Zero MDR on UPI P2M no longer applies across the full ticket range. From 15 October 2026, zero MDR applies to bank-account UPI at or below ₹2,000 and to RuPay debit across the full range; above ₹2,000 on bank-account UPI, the notified 0.4% (capped ₹300 at or above ₹75,000) applies. The notified framework is currently subject to a pending Supreme Court challenge (PIL filed 16 September 2026).

What does zero-MDR actually cover after 15 October 2026?

The zero-MDR mandate now runs in bands, not as a single blanket rule.

Bank-account UPI, at or below ₹2,000 per transaction — zero MDR. The narrowed Section 10A of the Payment & Settlement Systems Act 2007 (as amended by the Taxation and Other Laws (Amendment) Act 2026, Presidential assent 17 August 2026, notified 14 September 2026) preserves the statutory bar against network MDR on this band. About 95% of UPI P2M transactions by count sit here on NPCI’s own figure (though a materially smaller share by value, since larger tickets are a small share of count but a large share of rupees). This is the primary zero-MDR base a merchant reconciliation runs against.

Bank-account UPI, above ₹2,000 — notified 0.4% MDR (capped ₹300 at or above ₹75,000) from 15 October 2026. This band is no longer zero-MDR. NPCI’s FAQ dated 15 September 2026 crystallises the rate; a positive MDR line in this band on a settlement file from 15 October onward is expected, not leakage. The audit question in this band is whether the effective rate matches 0.4% (or the ₹300 cap above ₹75,000), not whether a charge exists.

RuPay debit, full range — zero MDR (unchanged). The Ministry of Finance notification of 14 September 2026 narrowed the Section 10A protection only for UPI P2M above ₹2,000; RuPay debit remains fully covered. A positive MDR line on any RuPay debit transaction is still Pattern #1 leakage in its original form.

RuPay-credit-on-UPI — out of scope of the new MDR (FAQ Q36). Continues to follow its own schedule (zero interchange at or below ₹2,000, approximately 2% above ₹2,000 per the NPCI circular operative since October 2022). PPI and wallet-on-UPI carry interchange of 0.5% to 1.1% above ₹2,000 under the NPCI wallet-interoperability circular dated 24 March 2023. Credit-line-on-UPI is another distinct instrument with its own commercials. These three cells are not zero-MDR — and Pattern #3 of the leakage taxonomy is the case where they masquerade under a generic “UPI” label on the settlement file. Their treatment is unchanged by the 15 October regime change.

Sector overrides on bank-account UPI above ₹2,000. Five essential-service sectors named in the FAQ — railways, telecom, insurance, fuel (petrol/diesel/CNG), and utility bill collection (electricity/water/gas) — pay a flat ₹5 per transaction above ₹2,000, not the 0.4%; education (school/university fees) falls under the same designated Industry program category, but Q42 states only “flat-fee structures or capped processing rates” for it, with no specific figure (the ₹5 sectors per FAQ Q33, Q39-Q41; education per Q42; the FAQ’s own phrasing is non-exhaustive — “such as … among others” — and refers to a “designated Industry program category” it does not itself fully enumerate). Capital markets (AMCs/mutual funds, SEBI-registered brokers, securities dealers) pay 0.02% capped ₹300 (FAQ Q37, Q38). Agricultural inputs are well-corroborated across press coverage of the underlying NPCI circular as also sitting in the essential-services flat-₹5 category, though not named in the FAQ PDF itself — held to press-corroborated tier one level below the FAQ-sourced facts. For a merchant in one of these categories, a 0.4% MDR line on a ₹5,000 transaction is over-billing, not the notified charge.

Small merchants under the P2PM exemption. Merchants whose inward UPI QR receipts are at or below ₹1 lakh per month sit in a separate P2PM category and stay at zero MDR (FAQ Q23, Q24, Q28). No GST registration is required to qualify — the eligibility test is monthly collection threshold plus bank-account categorisation only. A merchant is formally moved into the chargeable P2M category once inward UPI credits exceed ₹1 lakh per month for three consecutive months (FAQ Q29) — a new, actionable, previously-nonexistent compliance-monitoring trigger. A merchant currently sitting comfortably under ₹1 lakh/month should have a reconciliation trigger set well before that threshold hits three consecutive months.

How does this leakage happen?

There are four operating mechanics that produce fee-file exceptions after 15 October 2026, and a controller running a fresh per-network audit will encounter them across different gateways and different merchant categories. The first three are the classical Pattern #1 mechanics from the pre-15-October world, restricted post-15-October to the bands where they remain illegitimate; the fourth is a new mechanic that the regime change makes possible.

Flat platform fee billed against genuinely zero-MDR volume. The classical pattern, now band-restricted. A gateway publishes a headline 1.95% or 2% blended rate that is meant to be a platform fee for routing, reconciliation, fraud screening, and dashboard. The same flat percentage is then applied to the merchant’s bank-account UPI volume at or below ₹2,000 (still zero-MDR statutorily) and to the merchant’s full RuPay debit volume (unchanged, still zero-MDR full-range). The merchant sees one line called “MDR” or “gateway fee” against UPI volume and reads the magnitude as roughly 2%; the legal network MDR is zero for those cells, and the contracted platform fee for a UPI-heavy enterprise account is typically a fraction of the card-grade percentage. The over-billing is the difference between the flat card-grade percentage and the contracted UPI-specific rate. This mechanic remains live and remains recoverable on the at-or-below ₹2,000 UPI band and on the RuPay debit full range.

Mis-labelled instrument. A bank-account UPI transaction is classified on the settlement file as a card or wallet payment, picking up the corresponding card-rate MDR. This shows up as a per-transaction anomaly rather than a per-network systematic gap, and the detection is a join between the instrument classification on the gateway’s settlement file and the UPI reference (RRN/UMN) on the merchant’s order-management system. Unchanged in shape by the regime change; the anomaly is still leakage regardless of ticket size, because the mis-classification (bank-account UPI billed as card) itself produces a rate materially higher than the notified 0.4%.

Card-grade MDR applied where the notified UPI schedule applies. The settlement file shows a percentage line explicitly called “MDR” on a bank-account UPI cell above ₹2,000 at, say, 1.5% or 2% — not the notified 0.4%. Post-15-October, the dispute is not “there should be no MDR at all” but “the MDR should be 0.4% flat between ₹2,000 and ₹75,000 and capped at ₹300 above ₹75,000, not the card-grade percentage.” The recoverable leakage is the gap between the billed rate and the notified rate, applied to the affected volume. On the at-or-below ₹2,000 band and on RuPay debit, the dispute is still “no MDR at all” — the classical Pattern #1 shape.

Cap not enforced on tickets at or above ₹75,000. A new mechanic the regime change makes possible. Above ₹75,000, the notified MDR is ₹300 flat per transaction, not 0.4% (which would climb linearly with ticket size). A settlement file that continues to bill 0.4% on transactions above ₹75,000 produces over-billing that grows with ticket size — for a ₹2,00,000 transaction, 0.4% is ₹800 versus the cap of ₹300, a ₹500 over-charge per transaction. For a merchant with meaningful large-ticket UPI volume (B2B invoicing, wealth management, real-estate booking amounts, invoice settlements), this is a distinct and growing recoverable exception even where the base rate matches 0.4%.

Where does the leakage hide on a settlement file?

Four places, post-15-October.

The percentage column, on cells that remain zero-MDR. Any non-zero value in a column called “MDR” or “TDR” or “Network MDR” against a bank-account UPI transaction at or below ₹2,000, against any RuPay debit transaction, or against a RuPay-credit-on-UPI transaction (out of scope of the new MDR) is a flag, full stop. There is no legitimate non-zero MDR in those cells.

The percentage column, on cells that carry the notified rate. Above ₹2,000 on bank-account UPI, the deterministic check has changed shape: the flag is no longer “MDR is non-zero” (that is now expected) but “MDR is materially different from 0.4% flat between ₹2,000 and ₹75,000, or from a ₹300 cap above ₹75,000.” Sector overrides matter here: on an essential-service merchant category (railways/telecom/insurance/fuel/utilities), the flag is “MDR is not the flat ₹5 per transaction above ₹2,000” (education: verify the aggregator-confirmed figure per Q42 before flagging); on a capital-markets merchant, the flag is “MDR is not 0.02% capped ₹300.”

The line label. Many gateways label their platform fee as “MDR” on the settlement file because the historical convention treated the entire merchant cost as MDR. The label itself does not constitute leakage; what matters is the underlying classification. Audit discipline still requires separating “platform fee” (aggregator/gateway commercial fee, billed at the contracted rate, unchanged in kind by the regime change) from “network MDR” (band-aware post-15-October). The dispute language must use the right term — a gateway will defend the platform fee as a legitimate cost and will now also defend a 0.4% network MDR on bank-account UPI above ₹2,000 as the notified schedule; the merchant’s dispute must be sharpened to the specific band and specific rate.

The GST treatment. GST at 18% applies on the merchant fee (both on the new MDR and on any legitimate platform fee), not on transaction value. If the GST line is calculated on the gross UPI value and not on the fee, that is a separate compliance error layered on top of the MDR-on-UPI question. Reconcile the GST line against the fee line, not against the settlement-credit amount; the fee with 18% GST is what enters the merchant’s ITC claim. The 18%-on-MDR treatment is corroborated across secondary press coverage of the 14 September 2026 notification and 15 September 2026 FAQ, though not explicitly stated in the FAQ PDF itself — a check against a CBIC or GST-Council source is recommended for finance teams closing the book on a large post-15-October settlement period.

Worked example: B2B SaaS, ₹4 crore monthly UPI bank-account volume, post-15-October ticket-size split

A B2B SaaS company processing ₹4 crore monthly UPI bank-account volume is on a Razorpay plan with a published flat rate of 2%. In this illustrative case the volume splits by ticket-size band as follows (representative of a mid-market B2B SaaS with a mix of small self-serve subscriptions, mid-market enterprise-tier invoices, and a small number of large annual-plan settlements):

• At or below ₹2,000: ₹40 lakh (10% of volume, ~85% of transaction count) — zero-MDR band
• ₹2,000 to ₹75,000: ₹2.60 crore (65% of volume) — 0.4% notified band
• At or above ₹75,000: ₹1.00 crore (25% of volume) — ₹300 cap band; 100 transactions averaging ₹1,00,000 each (every transaction sits above the ₹75,000 cap threshold)

The pre-15-October settlement file (which the merchant is auditing after the regime change) shows a single “MDR” line of ₹8,00,000 on the full ₹4 crore UPI bank-account volume — that is, 2% of ₹4 crore, applied without band awareness.

Restating against the correct schedule:

• At-or-below ₹2,000 band (₹40 lakh volume) — expected network MDR: ₹0 (statutory zero, Section 10A of the PSS Act as amended). Billed line at 2%: ₹80,000. Recoverable Pattern #1 leakage in this band: ₹80,000.
• ₹2,000 to ₹75,000 band (₹2.60 crore volume) — expected network MDR: 0.4% flat = ₹1,04,000 (notified schedule, effective 15 October 2026). Billed line at 2%: ₹5,20,000. Recoverable over-billing: ₹5,20,000 minus ₹1,04,000 = ₹4,16,000.
• At-or-above ₹75,000 band (₹1.00 crore volume, 100 transactions at avg ₹1,00,000) — expected network MDR: ₹300 x 100 = ₹30,000 (cap enforcement — raw 0.4% on ₹1,00,000 would give ₹400 per transaction, capped to ₹300). Billed line at 2%: ₹2,00,000. Recoverable cap-breach: ₹2,00,000 minus ₹30,000 = ₹1,70,000.
• Total recoverable MDR overrun in this month: ₹80,000 + ₹4,16,000 + ₹1,70,000 = ₹6,66,000.
• Legitimate MDR under the notified schedule for the month: ₹0 + ₹1,04,000 + ₹30,000 = ₹1,34,000. This is the merchant’s expected cost, not the recoverable pool.

Separately, the platform fee (aggregator/gateway commercial fee for routing, dashboard, reconciliation, risk) is unchanged in kind by the regime change and continues to be reconciled against the contracted enterprise rate per the merchant’s master service agreement — a separate audit line from the network MDR above.

The gateway dispute is now three-part, sharpened by band:

• On the at-or-below ₹2,000 band and on RuPay debit and RuPay-credit-on-UPI: the deducted MDR must be zero. Reclassify at zero and refund the difference.
• On the ₹2,000-₹75,000 band: the deducted MDR must be 0.4% flat per the 15 September 2026 NPCI FAQ. Reclassify at 0.4% and refund the gap.
• On the at-or-above ₹75,000 band: the deducted MDR is capped at ₹300 per transaction. Reclassify at ₹300 per affected transaction and refund the gap.

The merchant does not argue that Razorpay’s aggregator commercial fee is zero, and no longer argues that all UPI MDR is zero — Razorpay is a regulated payment aggregator providing a real service, and above ₹2,000 the network MDR is now the notified schedule, not zero. The merchant argues, for each band, that the actual deduction must match the correct schedule for that band. The gateway re-cuts the settlement per band, refunds the differences for the disputed periods, and updates the rate card on the account.

GST at 18% follows the corrected fee, not the original — both on the corrected legitimate MDR (₹1,34,000 x 18% = ₹24,120) and on any legitimate platform fee (a separate calculation depending on the contracted enterprise rate). These are separate lines, claimable as input tax credit per the standard GST treatment for payment-aggregator services subject to the standard conditions.

For an even ticket-size profile a merchant can hold the same three-band structure and re-plug their own volumes; the recovery pool shape depends on how much of the merchant’s UPI volume sits in each band.

Detection technique: the per-network effective-rate audit

The detection methodology is the same regardless of gateway and the same regardless of business model. The discipline is to compute an effective rate per network — total fees divided by network-specific volume — and compare it to the contracted rate per network. The headline blended rate billed at the account level is not the reconciliation baseline; the per-network contracted rate is. A blended 2% headline conceals a zero-MDR UPI cell, a 0.30% to 0.90% RBI-capped non-RuPay debit cell, a ~2% Visa/Mastercard credit cell, and a 2.95% to 3.5% Amex/Diners cell — the per-network decomposition is the only way to see leakage in the UPI cell distinctly from leakage in the Amex cell.

The audit runs in five steps.

Step 1 — Decompose by instrument and network. Take the settlement file for a representative period (one month for a regular cycle; one quarter if the monthly volume is concentrated). Split every transaction into (a) instrument — UPI, card, net banking, wallet, EMI — and (b) network — UPI bank-account, RuPay credit on UPI, PPI on UPI, RuPay debit, Visa/Mastercard debit, Visa/Mastercard credit, Amex, Diners, international card. A UPI transaction that is not decomposed into the three UPI sub-networks should be reclassified per the RRN/UMN before the audit begins.

Step 2 — Sum volume and fees per network. Build a matrix where each row is a network and the columns are total volume, total deducted fee, total GST, and effective rate (deducted fee divided by volume).

Step 3 — Flag zero-MDR cells with non-zero MDR (band-aware post-15-October). The deterministic check now runs in bands. Any positive value in the effective-rate column on (a) bank-account UPI transactions at or below ₹2,000, (b) any RuPay debit transaction, or (c) any RuPay-credit-on-UPI transaction (explicitly out of scope of the new MDR per FAQ Q36) is the Pattern #1 flag in its original form. This is the deterministic check for these bands.

Step 4 — Reconcile the notified schedule on the above-₹2,000 bank-account UPI bands. In the ₹2,000 to ₹75,000 band on bank-account UPI, the expected MDR is 0.4% flat; flag any material variance. Above ₹75,000, the expected MDR is capped at ₹300 per transaction; flag any transaction where the deducted MDR exceeds ₹300. Apply sector overrides where the merchant’s category qualifies (railways, telecom, insurance, fuel, and utility bill collection pay flat ₹5 above ₹2,000; education is flat-fee-or-capped per Q42 with no stated figure; agricultural inputs held to press-corroborated tier; capital markets pay 0.02% capped ₹300). This is the deterministic check for the notified bands.

Step 5 — For non-zero-MDR cells outside UPI, continue to Patterns #2 through #8. Amex/Diners premium slab, premium/rewards cards, commercial/corporate cards, domestic-as-international, refund non-reversal, recurring add-on stacking, and flat-rate cross-subsidy — the rest of the merchant-fee leakage taxonomy is unchanged.

Step 6 — Quantify recovery per cell, per band, and per month. For the zero-MDR-band exceptions, the recoverable is the full deducted MDR line in the band. For the above-₹2,000 UPI bands, the recoverable is the gap between the deducted MDR and the notified rate (0.4% or the ₹300 cap or the sector override). For the platform-fee line (unchanged by the regime change), the recoverable is the gap between the effective rate and the contracted enterprise rate. Multiply per volume, annualise, compile the per-transaction exception list as evidence for the gateway dispute.

What is the recovery playbook?

Disputes on Pattern #1 are clean because the law is unambiguous. The playbook has three steps.

Step A — Open the dispute with a transaction-level exception report, not a summary. The gateway account manager will defend the magnitude until they see the per-transaction list with the network classification, the ticket-size band, the deducted line, the notified schedule (Section 10A of the PSS Act as amended for the zero-MDR bands; 15 September 2026 NPCI FAQ hosted on financialservices.gov.in for the notified bands), and the contracted rate for the platform-fee line. A summary creates negotiation room; a per-band transaction list creates a deterministic claim. NPCI’s public FAQ position is the primary citation post-15-October and takes precedence over any older summary framing.

Step B — Request reclassification, band by band, not a single “refund” line. The dispute is now three-part in kind:

• On the at-or-below ₹2,000 UPI band, on RuPay debit, and on RuPay-credit-on-UPI, the deducted MDR must be zero — reclassify at zero and refund the full deducted line.
• On the ₹2,000-₹75,000 UPI band, the deducted MDR must be 0.4% (or the sector override where applicable) — reclassify at the notified rate and refund the gap.
• On the at-or-above ₹75,000 UPI band, the deducted MDR must be at most ₹300 per transaction — reclassify at the cap and refund the gap. Separately, the platform-fee line reclassifies to the contracted enterprise rate as a distinct dispute head.

This framing prevents the gateway from booking a single “goodwill credit” line that muddles legitimate MDR under the notified schedule with recovered over-billing, and it survives the next monthly cycle cleanly.

Step C — Update the rate card on the account, per band. The settlement-period refund is the recovery for past leakage. The forward-looking remediation is the corrected rate card on the account — UPI bank-account MDR set to zero at or below ₹2,000, 0.4% (or the sector override) between ₹2,000 and ₹75,000, capped ₹300 at or above ₹75,000; RuPay debit MDR set to zero full-range; the platform-fee line set to the contracted enterprise rate per network. Confirm in writing (account-management email is sufficient) that the corrected per-band schedule is live on the account from a specified settlement period onward, and re-run the per-network per-band effective-rate audit on the first settlement after the corrected card to verify.

For a B2B SaaS, the dispute typically resolves in two to four weeks at the account-manager level. Where it does not, escalation is to the gateway’s enterprise relationship leadership, with the regulatory citations and the transaction-level exception list as the dispute pack. Reconciliation discipline thereafter is to run the per-network audit on every monthly settlement so the next misclassification is caught in the same cycle it appears, not annualised.

How does this interact with TDS and GST?

Three reconciliation lines per UPI transaction, kept separate at all times.

Network MDR. Zero on UPI bank-account and RuPay debit. Any positive number here is the Pattern #1 flag.

Platform fee with 18% GST. Legitimate gateway charge at the contracted enterprise rate, with 18% GST on the fee (not on the transaction value). The platform fee plus GST is the merchant’s deduction from the gross transaction value; GST is claimable as input tax credit subject to the standard conditions.

TDS by the e-commerce operator where applicable. Under the Income-tax Act 2025 framework live since 1 April 2026, the e-commerce operator deducts on payments to the e-commerce participant on gross transaction value at 0.1% under Section 393(1) Sl. 8(v) using payment code 1035 (the legacy 194O at 0.1% effective from 1 October 2024 carries forward at the same rate; the older 1% rate was pre-October 2024 and should not appear in current reconciliations). 5% applies under the PAN/Aadhaar default rule (legacy 206AA equivalent). No threshold for companies, firms, and LLPs; ₹5 lakh threshold for resident individuals and HUFs with PAN/Aadhaar. The TDS line is distinct from MDR and from GST on MDR — keep all three as separate lines and reconcile each to the appropriate statutory artefact (Form 26AS for TDS, GSTR-2B for GST input tax credit, gateway settlement file for fees).

For a B2B SaaS selling directly to enterprise customers through its own checkout, code 1035 typically does not bite because the SaaS company is not selling via a third-party e-commerce operator. For an OTT or D2C business selling through an aggregator, the operator deducts code 1035 at 0.1% on gross transaction value and the merchant claims it in Form 26AS. None of this introduces any network MDR on a bank-account UPI debit.

What does “good” look like after remediation?

A controller running the per-network per-band effective-rate audit one settlement period after remediation should see:

• Network MDR on bank-account UPI at or below ₹2,000: zero (“MDR” column reads zero on those transactions).
• Network MDR on bank-account UPI, ₹2,000 to ₹75,000: 0.4% flat (or the sector override where the merchant category qualifies — flat ₹5 above ₹2,000 for essential-services categories, 0.02% capped ₹300 for capital markets).
• Network MDR on bank-account UPI, at or above ₹75,000: capped at ₹300 per transaction (the deducted line stops growing with ticket size at the cap).
• Network MDR on RuPay debit: zero across the full ticket range. RuPay-credit-on-UPI: zero at or below ₹2,000, approximately 2% above — it is out of scope of the new MDR per FAQ Q36 and follows its own separate schedule that this article does not modify.
• Platform fee (aggregator/gateway commercial fee, unchanged in kind by the regime change) equal to the contracted enterprise rate per network, labelled as platform fee rather than MDR on the settlement file.
• Effective rate on Visa/Mastercard debit cells within the RBI cap (0.40% for merchants with annual turnover up to ₹20 lakh, 0.90% above; 0.30% / 0.80% for QR; per-transaction cap of ₹200 / ₹1,000).
• Effective rate on Visa/Mastercard credit within the contracted enterprise rate (commonly 1.4% to 1.6% for crore-scale monthly volume) and Amex/Diners separately and explicitly priced rather than blended into the standard cell.
• GST at 18% on the fee (both the notified MDR and any platform fee), not on transaction value, as a separate line.
• Refund credits on disputed periods explicitly tied per band and per instrument, not as a single goodwill credit.
• P2PM small-merchant graduation monitor live on the merchant’s finance dashboard where the entity qualifies — a ₹1 lakh/month rolling threshold with a 3-consecutive-month trigger that surfaces well before the merchant crosses into P2M chargeability.

The forward-looking discipline is monthly. The per-network audit takes one analyst-day per month once the data pipeline is in place, and the recovery for a UPI-heavy merchant in the first audit usually pays for the discipline several times over.

Continue reading in this cluster

• UPI MDR 2026: the definitive current-state flagship — the 0.4% P2M merchant charge effective 15 October 2026, full band schedule, sector overrides, P2PM small-merchant exemption + graduation rule, and the six-check merchant reconciliation playbook. Currently subject to pending Supreme Court challenge (PIL filed 16 September 2026).
• Amex and Diners surcharge hidden inside blended MDR — Pattern #5
• MDR not reversed on refunds and chargebacks — Pattern #7
• RuPay credit on UPI masquerading as UPI — Pattern #3
• Merchant-fee leakage cluster hub — all eight patterns
• Payment gateway reconciliation — money page