NPCI mandates masking of phone and account numbers in UPI transactions
India's NPCI has mandated UPI apps to mask customers' phone and account numbers during transactions by September 2026. The change aims to enhance user privacy and security.
The National Payments Corporation of India (NPCI) has instructed all banks and UPI applications to stop displaying customers' full mobile numbers during transactions, with a compliance deadline of September 4, 2026. This directive addresses growing concerns over safety and identity theft risks associated with visible phone numbers.
Under the new rules, only the last four digits of a user's registered mobile number will be visible to the other party involved in a transaction. Full mobile numbers will also not be displayed in QR code payments. Account numbers and UPI IDs (Virtual Payment Addresses, or VPAs) will be subject to the same masking requirement.
Furthermore, NPCI is directing apps to set a username-based VPA as the default for new users, rather than a mobile-number-based one. This aims to allow users to transact without their phone number being intrinsically linked to their payment identity, reducing the risk of their number being traced or misused.
The move aligns with India's Digital Personal Data Protection (DPDP) Act. UPI is India's primary digital payments platform, serving over 550 million users. The technical changes require coordination between banks, NPCI, and app developers to ensure a cohesive implementation before the deadline.