NPCI plans to mask phone numbers on UPI apps to boost user privacy

Following privacy concerns, NPCI has asked UPI apps to hide phone numbers and make username-based payment IDs the default for new users

  The National Payments Corporation of India (NPCI) is working with banks and UPI apps to strengthen user privacy by reducing the amount of personal information visible during digital payments, according to a report by Moneycontrol. The move comes as the Digital Personal Data Protection (DPDP) Act reshapes how organisations handle personal data, with mobile numbers and full names increasingly viewed as sensitive information.

 

Why is NPCI making this change?

 

The NPCI is introducing this change to protect user privacy and strengthen data security.

 

Many UPI apps currently display a user's full name or registered mobile number during transactions, exposing sensitive personal details. Following a surge of complaints — particularly from women users raising concerns about harassment, identity exposure, and personal safety — NPCI issued a circular instructing payment apps to mask registered mobile numbers.

 

 

Additionally, with the DPDP framework placing greater responsibility on organisations to safeguard personal data, NPCI aims to mitigate privacy risks across the ecosystem. Payment apps have reportedly been given until September 4 to implement these changes, according to Moneycontrol.

 

What changes could users see?

 

Under NPCI's circular, customer-facing interfaces on banks' and UPI apps will be required to mask sensitive information such as UPI IDs, mobile numbers, and account numbers.

 

Only the last four digits of a user's mobile number should be visible to the other party, while mobile numbers should not be displayed after payments made through QR codes.

 

Another key change relates to users' Virtual Payment Address (VPA), which is the unique UPI ID used to send and receive money. While UPI has always allowed users to choose a username-based VPA, many first-time users end up selecting their registered mobile number because they are unaware of the alternative.

 

NPCI now wants UPI apps to make a username-based VPA the default choice instead of a mobile number-based one. This is expected to significantly improve user privacy by reducing the visibility of phone numbers during transactions.

 

The changes will require banks and payment service providers to update their systems to comply with the DPDP Act and NPCI's privacy expectations. The aim is to improve privacy without affecting the speed or convenience of digital payments.