NPCI asks UPI apps to mask phone numbers and shift new users to username IDs
NPCI has directed banks and UPI apps to mask mobile numbers, account numbers and UPI IDs on transaction screens. New users will be steered to username-based VPAs, requiring coordinated app and bank-system changes by September 4, 2026.
What happened
NPCI has directed banks and UPI apps to mask customer phone numbers, account numbers and UPI IDs on transaction screens, while making username-based VPAs the
Key facts
- September 4, 2026 compliance deadline
- Last four digits of mobile number visible
- Over 550 million UPI users
- Approximately Rs 314 lakh crore UPI transaction volume in FY 2025-26
Why this matters
Payments platforms should assess partnerships or acquisitions in privacy-preserving identity, VPA management and fraud-resolution tooling as phone-number-based discovery becomes less central to UPI.
What to watch
- NPCI clarification on whether existing mobile-number VPAs remain usable, are automatically aliased, or face eventual retirement.
- Specification of username uniqueness, portability, rename limits, reserved words and dispute-resolution rules.
- Mandates for verified beneficiary names, display-name standards and anti-lookalike controls across UPI apps.
- Early data on payment failure rates, beneficiary-addition abandonment, customer-support contacts and fraud complaints after rollout.
- Whether major apps make usernames interoperable and portable or create differentiated discovery and identity experiences.
- Merchant-acquirer guidance on reconciliation fields, payer-data availability and QR/payment-link compatibility.
- UPI apps will introduce username-selection, availability checks, rename rules and clearer verified-recipient display conventions.
- Banks and PSPs will map legacy mobile-linked VPAs to username-based aliases while preserving backward compatibility for existing mandates, beneficiaries and merchant integrations.
- Merchant payment providers will update checkout, QR, payment-link and reconciliation systems to rely less on visible payer identifiers.
- Apps will expand recipient-confirmation features, including verified names, risk prompts, transaction-history cues and warnings for newly created or edited usernames.
- Brands, creators and small merchants will begin promoting memorable UPI usernames as payment handles, creating a market for recognizable and potentially contested IDs.