India built the world's largest public payment and identity system and made it free at the point of use. The costs did not vanish. They moved onto the people least able to carry them, and off the books the state keeps.

The one-time password does not come. You are standing at a counter, or in front of a screen, and the money is in the account, and the account is linked, and the intention is there, and the small grey box waits for six digits that a distant server has not sent. You wait. The person behind the counter waits. The queue behind you waits. After ninety seconds, the box tells you to try again, so you try again. Somewhere inside that ordinary delay sits a question the country's celebrated payment and identity system has never been built to answer. Who pays for the friction, how much, and does anyone anywhere keep the figure?

Most of us who own a working smartphone and a stable fingerprint feel this as nothing worse than irritation. A minute gone. A second attempt. The transaction clears, and the irritation is forgotten by evening. That forgetting is the mechanism. The cost is real while it lasts and gone the instant it ends, which is exactly why it never enters any account the state or the market chooses to maintain. For a widow in a Jharkhand village whose fingerprint no longer reads, the same friction does not end by evening. It ends when she gives up, or when she is struck off a list as a "ghost", or, in forty-two documented cases since 2017, when she dies without the ration she was legally owed. The same technology. The same instruction to try again. A very different life on the other side of the glass.

This essay is about that distance: between the friction the comfortable forget within the hour and the friction that decides whether the poor eat, and about why the distance stays out of sight. I write it as someone who thinks the Jan Dhan-Aadhaar-Mobile system solved real problems of exclusion and created new ones the government has decided not to look at, and who reads the official celebration of it with the doubt its own missing numbers earn. The argument is not that the rails should be torn up. It is that a system this large cannot be called a success while the single most important thing about it, the rate at which it fails the people it was built for, is a number nobody is required to publish.

The rail that was sold as free

The phrase itself came from inside the government. "JAM", for Jan Dhan, Aadhaar and Mobile, was coined in the Economic Survey 2014-15 by the then Chief Economic Adviser Arvind Subramanian, who described the three as a single pipe through which the state could send money to the poor without the middlemen skimming it on the way. The promise was elegant and, on its own terms, largely kept. By August 2025, the Pradhan Mantri Jan Dhan Yojana reported 56.16 crore accounts, 55.7 per cent of them held by women and two-thirds in rural and semi-urban India, with ₹2.68 lakh crore on deposit and an average balance of ₹4,768. Aadhaar enrolment reached about 138 crore. In FY 2024-25, the Direct Benefit Transfer system moved ₹6.9 lakh crore into those accounts.

The payment layer scaled faster than anyone forecast. The Unified Payments Interface carried 185.8 billion transactions worth ₹260.6 lakh crore in FY25, about 83.4 per cent of the retail payments system by volume, and crossed 241 billion transactions worth roughly ₹314 lakh crore in FY26. These are the numbers on the ministry's slides. They are all throughput numbers. Accounts opened. Transactions cleared. Rupees moved. Aadhaar seeded.

James Scott's account of how states learn to see, in Seeing Like a State, is useful here, though it needs turning around. Scott argued that modern states simplify populations into forms they can read, standardising names and plots and identities so that citizens become legible to the administration. JAM did that with unusual thoroughness. What it did not do was make the administration legible to the citizen.

The direction of sight is one-way. The state can now find you, dock you, delete you and pay you, and can count each of those events. You cannot see why your fingerprint failed, cannot appeal to the server that did not send the code, and cannot find, anywhere in the published record, the count of people to whom the same thing happened this month. The system measures its own reach with great care and its own failure not at all.

The friction is a tax, and it is regressive

Start with the best evidence, because the strongest case here rests on an experiment rather than an anecdote. Karthik Muralidharan, Paul Niehaus and Sandip Sukhtankar ran a randomised trial across 15.1 million beneficiaries of Jharkhand's Public Distribution System, staggering the rollout of Aadhaar-based biometric authentication so its effects could be isolated. Their finding was blunt. Requiring a fingerprint to collect rations, on its own, did not cut leakage, and it slightly raised transaction costs for the average beneficiary. Where a later phase did reduce diversion, it did so at the cost of higher exclusion; legitimate households turned away. The same team's earlier work in Andhra Pradesh had found no such exclusion, and they attribute the difference to design rather than state capacity: Andhra kept offline authentication and backup payment routes, and Jharkhand did not. When the fallback exists, the technology can help. When it does not, the machine becomes the gatekeeper.

Jean Drèze, Nazar Khalid, Reetika Khera and Anmol Somanchi reached the harder reading of the same terrain in their 2017 study for the Economic and Political Weekly, "Pain without Gain?", finding that compulsory biometric authentication in Jharkhand imposed real hardship without a matching gain in targeting. Khera's later compilation for the EPW documented the forty-two hunger-related deaths I mentioned at the start, concentrated among exactly the people biometrics serve worst: the old, whose fingerprints have worn smooth, the manual labourer whose ridges are scarred, the disabled person who cannot reach the shop, the widow living alone with no second name on the card to authenticate in her place.

How large is the failure at the scale of the whole system? The honest answer is that we are forced to reconstruct it from fragments, because it is not published directly. UIDAI's own figures, as read into recent parliamentary replies and compiled this year, imply roughly 312 million biometric authentications a month with about 20.3 million failing, a failure rate near 6.5 per cent that has barely moved in a decade. A study of Andhra Pradesh's PDS for a single fortnight in December 2017 put the average failure at 2.5 per cent, more than nine-tenths of it caused by fingerprint mismatch. In Rajasthan in July 2017, by contrast, a third of Aadhaar-seeded ration cardholders could not draw their grain because the fingerprint would not take. The range is wide, and the wideness is itself the finding: failure is not evenly spread but concentrated where the connectivity is weakest, the devices oldest and the hands most worn, which is to say among the poorest.

I will not use the figure of 66 per cent authentication failure that circulates online, because it comes from 2018 advocacy analysis rather than a representative survey, and thin evidence does not become strong by being repeated. It does not need to. The RCT and the six-and-a-half per cent aggregate are enough.

Here is the point Amartya Sen's capability framework forces us to hold onto. A bank account is an access. Being able to draw your money, this month, at the counter you can reach, without losing a day's wage to a failed fingerprint, is functioning. The government counts the first and never the second. The distance between them is a cost, and because it falls in lost time, forfeited wages and abandoned entitlements rather than in a fee anyone charges, it is a cost with no line item. Coase and Williamson taught us to treat transaction costs as real economic costs even when no invoice records them. The friction of authentication is a transaction cost of precisely this kind, and it is regressive by construction, because the daily-wage worker who loses half a day to a broken ePoS machine has surrendered a far larger share of her income than the salaried person who loses ninety seconds to an OTP.

The wages that the payment system deleted

The clearest demonstration that friction is a cost, and not an inconvenience, is what happened to the rural jobs programme when the payment plumbing was made mandatory. From 1 January 2024, every wage under the Mahatma Gandhi National Rural Employment Guarantee Act had to be paid through the Aadhaar-Based Payment System, which requires a worker's Aadhaar to be seeded to the job card, the name on both to match, the bank account to be Aadhaar-linked, and the account to be correctly mapped in the NPCI's own tables. Any break in that chain- a name spelt differently in English than in the ration record, a mapping that never completed- and the wage cannot be paid.

The field data on what this did is stark. LibTech India, tracking the programme on the ground, found that about 8.2 crore active workers were deleted as "ineligible" between October 2023 and October 2024, and that in the six months from April 2024 the churn produced a net loss of 39 lakh workers. In their Andhra Pradesh sample, roughly 15 per cent of the deletions were wrongful, genuine workers struck off, and more than a quarter of all registered workers remained ineligible for the payment system that had been made compulsory. Employment generated fell over the same window, from 184 crore person-days to 154 crore.

The word "ineligible" is doing a great deal of work in those official tables, and it is worth pausing on it. A worker whose Aadhaar will not map is not ineligible for work under the Act. She is ineligible for the payment rail the government has decided is the only permitted route to her wage. The state then records her removal as a deletion of a ghost, and the deletion appears in the accounts as a saving. This is the same conversion I traced in The Cash and the Category, where the reconstitution of welfare around identity turns a person denied into a leak plugged. The metric improves precisely because the exclusion is filed under a heading that sounds like success.

A public road with two private tollgates

Turn now to the money, because the second cost is not borne by the poor at all, at least not yet, and understanding who does bear it explains why the friction is tolerated.

Since January 2020, UPI and RuPay debit transactions have carried a Merchant Discount Rate of zero, made so through amendments to Section 10A of the Payment and Settlement Systems Act 2007 and Section 269SU of the Income Tax Act. The rail was declared free at the point of use. The costs of running it- the servers, the fraud systems, the reconciliation, the dispute handling- did not become zero; they were shifted onto banks and payment firms, and the government agreed to reimburse a slice through an annual budget incentive. That slice is thin.

The Department of Financial Services told the Parliamentary Standing Committee on Finance that the incentive covers about 11 per cent of the industry's actual cost, and about 14 per cent of the revenue the industry gives up by not charging. The public utility runs, in other words, on a subsidy that meets roughly a ninth of its bill, with the rest absorbed by the firms that operate it in the expectation of making the money back some other way.

Which firms? Two, mostly. On May 2026 data, PhonePe handled 46.2 per cent of UPI volume and Google Pay 32.7 per cent, a combined 79 per cent, the first month the pair slipped below four-fifths since the NPCI began publishing app-level shares. Add Paytm and the top three still moved 87 per cent, down from 95.2 per cent in January 2024. The concentration is easing at the margin, and it remains a duopoly on a public system, one of the two firms foreign-owned. The NPCI's own remedy, a rule capping any single app at 30 per cent of volume, was written in 2020 and has been postponed three times, most recently to 31 December 2026, a target the market is nowhere near meeting and shows little sign of being forced to meet.

Jean-Charles Rochet and Jean Tirole's work on two-sided markets is the frame the payments industry itself reaches for, and it repays reading in full rather than in slogan. Their insight was that a platform connecting two groups can rationally charge one side and subsidise the other to solve the problem of getting both to show up. UPI's early design subsidised both sides at once, users and merchants, to break cash's grip. The industry's argument now is that the adoption problem is solved and the pricing should normalise. That may be sound economics. It also quietly concedes the political point: a system presented to the public as a free good is, in its own operators' understanding, a two-sided market waiting for its price. The value being accumulated in the meantime is not only forgone fees. It is the transaction record itself, the raw material for the lending businesses that PhonePe, Google Pay and their peers are building on top of the rail, where the real margin lies. The state laid the road, and two private firms run the tollgates, and the toll, for now, is data.

The bill the state is now drafting

The price is no longer hypothetical. As of 17 and 18 July 2026, the government is actively weighing a return of MDR on merchant UPI payments, aimed only at large merchants, those with annual turnover somewhere around ₹1 crore to ₹1.5 crore or more, and only on transactions above ₹2,000, at a rate reported at five to seven basis points, roughly 0.05 to 0.07 per cent. Person-to-person transfers and the roughly nine-tenths of merchants who are small would stay outside it. No final decision has been taken, and the Finance Ministry denied the whole idea as recently as June 2025, so the accurate description is a specific proposal on the table and undecided rather than a done thing.

The design is defensible on its face. Charge the large, spare the small, protect the consumer. The question a development economist should ask is the one the two-sided-market literature answers only conditionally: does the fee stay on the side it is levied on? A modest charge on Amazon or Zomato is a rounding error to them and will not change behaviour. For a thin-margin organised retailer, it is a cost to recover, and the routes to recovery- higher shelf prices, minimum order values, convenience charges, delivery fees- are all invisible to the consumer as UPI charges and all quite visible in the final bill. Whether the tiered MDR protects consumers depends entirely on whether large merchants are barred from passing it through, a detail not yet written.

The RBI Governor has already said in public what the fiscal position makes unavoidable, that UPI is not truly free and that someone is paying the bill. He is right, and the budget line proves it: FY 2026-27 set aside ₹2,000 crore to keep the rail free, against an industry cost the DFS itself puts many times higher. This is the same fiscal squeeze I traced through the states in The Bill Comes Due, arriving now at the centre's payment subsidy. A commitment to keep something free, funded at a ninth of its cost, is not a policy so much as a deferral, and the deferral is ending.

Voluntary, and then not

The legal history is where the coercion becomes visible, and it is worth getting exactly right, because the case for the system rested on a promise the field evidence has since falsified.

In 2017, a nine-judge bench in Justice K.S. Puttaswamy v. Union of India held that privacy is a fundamental right under Articles 14, 19 and 21. The following year, a five-judge bench, by four to one, upheld the Aadhaar Act. It kept Section 7, which permits the state to make Aadhaar a condition for subsidies, benefits and services, and Section 139AA linking Aadhaar to PAN. It struck down Section 57, which had let private companies demand Aadhaar, struck down the national-security disclosure power in Section 33(2), and struck down the rule making Aadhaar compulsory for bank accounts and SIM cards as failing the test of proportionality. The Act had been passed as a Money Bill, bypassing the Rajya Sabha, and the majority let that stand.

The load-bearing sentence in the majority opinion is the one that has aged worst. The Court reasoned that Aadhaar does not cause exclusion because a beneficiary whose authentication fails after repeated attempts can still receive her entitlement by proving possession of an Aadhaar number some other way. The entire denial of the exclusion problem rested on a fallback the Court assumed would operate. The Jharkhand RCT, the LibTech deletions and the Rajasthan ration queues describe, in detail, a fallback that does not reliably operate. The judgment's factual premise was tested in the field and did not hold.

Justice D.Y. Chandrachud's dissent anticipated this precisely. He held Section 7 overbroad, warning that once Aadhaar is demanded for every benefit and service, it becomes, in his phrase, impossible to live in contemporary India without it, and he found the scheme failed proportionality because the state had not shown that a less intrusive method could not achieve the same targeting. That is the exit argument, already written into a Supreme Court dissent seven years ago. A market disciplines a bad product because the customer can walk away. A citizen cannot walk away from the only permitted route to her ration, her wage and her pension. The seeding that was sold as voluntary became, through administrative practice and mandatory payment rules like ABPS, the single door, and a single door with a 6.5 per cent failure rate is a door that shuts on twenty million people a month with nowhere else to go.

The numbers the state keeps, and the ones it does not

Return to the frame, because everything above is a reason the central failure stays hidden, and the hiding is a choice, not an accident.

The NPCI publishes UPI volume and value every month, promptly and in detail. It does not publish a failure rate broken down by cause. The one place a failure metric does appear is telling: inside the government's incentive scheme, a bank collects its final tranche only if its technical decline rate stays below 0.75 per cent and its uptime above 99.5 per cent. The state knows exactly how to measure decline when money for banks turns on it. It has chosen not to measure denial when rations for citizens turn on it. Muralidharan, Niehaus and Sukhtankar closed their study with an explicit recommendation to build real-time measurement of beneficiary experience and to add Aadhaar questions to the National Sample Survey. Seven years on, that recommendation sits unimplemented, and its non-implementation is the most eloquent fact in this essay.

Goodhart's law is usually quoted as a warning that a measure captured as a target stops measuring well. The sharper version here is the reverse. When the only published measures are throughput measures, the target becomes throughput, and the thing left unmeasured, exclusion, drops out of the definition of success entirely. You cannot fail at a metric you have declined to collect. The government's claim of cumulative DBT "savings" of around ₹3.5 lakh crore lives in exactly this gap. Reetika Khera and others have argued for years that the figure conflates the deletion of duplicates with the deletion of genuine beneficiaries, and RTI replies established that there was no data behind the claim that four crore ration cards removed by technology were bogus. A saving that counts the excluded as fraud is not a saving. It is the exclusion, recorded as a triumph. I made the same point about the centre's accounts in a different register in Reading the Centre's Books: what the state chooses to disclose, and what it chooses to leave uncounted, is itself a political decision, and reading it as such is half the analyst's job.

The friction returns, by design

There is a final turn, and it is the one that gives the whole story its shape. The system was sold on frictionlessness. It is now, deliberately, adding friction back, and the contrast between the two frictions tells you who each was designed for.

Digital-payment fraud losses have risen roughly forty-one-fold over five years to nearly ₹23,000 crore, driven largely by social-engineering scams in which the customer is manipulated into authorising the payment herself, so that every layer of OTP and PIN authentication is satisfied and the money still goes. Transactions above ₹10,000 account for about 45 per cent of fraud cases by number and 98.5 per cent by value. The RBI's response, set out in an April 2026 discussion paper and its 2025-26 annual report, is to introduce deliberate friction: a possible one-hour hold on payments above ₹10,000 before the money reaches the recipient, and a "kill switch" to freeze suspect flows. These remain proposals, not yet in force.

Hold the two frictions side by side. The friction the RBI is now engineering is precise, well-argued, backed by loss data, aimed at protecting the value that matters most to the banks and to the better-off customers who transact in five figures. The friction the poor already carry, the fingerprint that will not read, the OTP that will not arrive on a shared phone with no signal, the seeding that will not map, was never designed at all; it is a by-product, and it is measured by no one and defended by no budget.

The state can slow a ₹10,000 payment by an hour to save a scam victim's money. It has spent a decade unable, or unwilling, to tell us how many ration cards a broken fingerprint costs each month. Both are friction. Only one has an owner.

What would count as taking this seriously?

A system cannot be corrected on evidence it refuses to gather, so the first ask is a measurement one, and it is small. Put authentication-failure rates, disaggregated by scheme, cause and district, into the public monthly record the way UPI volume already is, and put an Aadhaar-experience module into the NSS, as Muralidharan and his co-authors asked in 2020. The second is a design ask the Supreme Court's own majority already assumed exists: a statutory, funded, genuinely available offline and human fallback at every point where Aadhaar is the gate, so that a failed fingerprint triggers a person and not a deletion. The third is a competition ask: enforce the 30 per cent cap the NPCI wrote and has deferred since 2020, before any MDR framework hardens the duopoly's hold on the toll. None of these is radical. Each is refused, and the pattern of refusal is the finding.

The widow in Jharkhand and the office worker cursing at a stalled OTP are standing in front of the same machine, hearing the same instruction. One of them will try again tomorrow and forget. The other will be counted, eventually, as a saving.

Varna is a development economist and writes at policygrounds.press.

Further reading

The exclusion evidence · Muralidharan, Niehaus and Sukhtankar, Identity Verification Standards in Welfare Programs (NBER 26744) · Balancing corruption and exclusion (Ideas for India) · Khera, Aadhaar Failures: A Tragedy of Errors (EPW) · Aadhaar authentication failure in Andhra Pradesh's PDS (ISB)

The rural jobs programme · LibTech India, MGNREGA Implementation April-September 2024 · Aadhaar linking and worker deletions (Down To Earth) · ABPS made mandatory for MGNREGS wages

The payments economics · Incentive scheme and the MDR debate (MediaNama) · The case for a tiered MDR (Business Standard) · MDR proposal for large merchants, July 2026 (Outlook Money) · Duopoly slips below 80 per cent (Outlook Business) · The 30 per cent cap, deferred to 2026 (MediaNama) · Indian Payments Handbook 2025-2030 (PwC)

The law · Constitutionality of the Aadhaar Act, in plain English (Supreme Court Observer) · Puttaswamy II analysis (Global Freedom of Expression) · Chandrachud's dissent (Privacy International)

The measurement and the fraud · UPI's share of the payments system, FY25 (Business Standard) · RBI weighs adding frictions to curb fraud (Business Standard) · Fraud losses and the proposed one-hour delay

Related pieces on policygrounds · The Bill Comes Due · Reading the Centre's Books · The Cash and the Category