The statement "In both the cases (UPI and Digital Rupee), the liability lies with the users and their respective banks" is incorrect because, in the context of UPI, while the transaction risks often rest on users and their banks, the UPI infrastructure itself is a facilitator, and the Reserve Bank of India (RBI) holds a regulatory role. In contrast, the Digital Rupee, being a central bank-issued digital currency, directly involves the RBI as the issuer, thus altering the risk profile and ensuring that the public has a reliable claim against the central bank, potentially shifting liability aspects. This distinction is crucial for understanding liability and regulatory frameworks in the evolution of digital payment systems and their security implications.