The NPCI has directed all UPI apps and banks to mask customer phone numbers by September 4 to improve user privacy. This shift away from mobile-number-centric identifiers toward username-based IDs aligns with India’s Digital Personal Data Protection laws. Users will see only the last four digits of mobile numbers during transactions, reducing the risk of personal data exposure.
Detailed Coverage
The National Payments Corporation of India (NPCI) has issued a mandatory directive requiring all Unified Payments Interface (UPI) applications and partner banks to mask customer phone numbers. This move is designed to enhance data security and ensure compliance with the Digital Personal Data Protection (DPDP) law. Entities operating within the UPI ecosystem have been given a firm deadline of September 4 to implement these updates.
Currently, many UPI transactions rely on mobile numbers for identification, which can expose personal information to the other party during a payment. Under the new protocol, apps will be required to display only the last four digits of a user's mobile number. Additionally, for payments made via QR codes, mobile numbers will no longer be visible after the transaction is completed. This regulatory step is a direct response to rising concerns over identity protection and privacy, especially among retail users.
Transition to Username-Based UPI IDs
A critical part of this mandate is the shift toward username-based Virtual Private Addresses (VPAs). While many users currently use their mobile numbers as their default UPI ID, the NPCI now requires apps to encourage and allow users to set up unique, username-based handles. These IDs will serve as the default identifier, effectively hiding the actual mobile number from others in the network. By shifting away from mobile-number-centric IDs, the NPCI aims to provide a more secure interface that protects user identity without disrupting the speed or ease of digital payments.
Regulatory Context and Implementation
The NPCI is currently working with banks and payment service providers to ensure that their digital infrastructure is updated to meet the September 4 deadline. This initiative is part of a broader regulatory effort to strengthen the safety of India’s digital payments sector, which handles billions of transactions monthly. By standardizing these privacy measures, the regulator is looking to align the payments ecosystem with the government’s focus on stricter data governance.
For users and market participants, the next important update will be the successful rollout of these features across major payment apps. Investors and stakeholders should monitor how quickly these platforms complete the technical migration and whether the change leads to a measurable increase in user adoption of username-based UPI IDs. While this change is largely operational and privacy-focused, it marks a significant evolution in how financial identity is managed within the UPI infrastructure.