UPI Data: Will masking the number alone make UPI data safe? Why is this privacy solution incomplete?

The National Payments Corporation of India (NPCI) is in discussions with UPI apps and partner banks regarding the implementation of the Digital Personal Data Protection (DPDP) Act to safeguard customer privacy. The NPCI, which operates UPI—the country's most popular digital payment platform—has already issued a directive to mask (hide) phone numbers. The UPI ecosystem relies on phone numbers for initiating and verifying payments; while this serves as a security feature, it also poses a privacy risk.

A senior executive from a UPI app told Moneycontrol, on condition of anonymity, that the implementation of the DPDP Act implies that phone numbers or full names could pose privacy risks. Consequently, the NPCI is engaging with banks and UPI apps to ensure their systems are prepared to address the roles and responsibilities of each stakeholder.

**Phone numbers to be masked**
Last month, the NPCI issued a circular to payment apps mandating the masking of customer phone numbers to enhance privacy and security. This move followed numerous complaints on social media from female users expressing concerns regarding identity, privacy, and security. The NPCI has set a deadline of September 4 for the implementation of this directive.

The NPCI stated that UPI member banks and UPI apps must prioritize user privacy. User details—such as UPI IDs, mobile numbers, and account numbers—must be masked across all customer-facing interfaces and communications used by UPI member banks and apps.

**Username-based UPI IDs**
The recipient should only be able to view the last four digits of the customer's mobile number. For transactions made via QR codes, the app should not display the mobile number after the payment is completed. The circular further mandates that UPI apps must provide users with the option to create an ID other than one based on their mobile number and to set it as their default UPI ID. 

When customers sign up for UPI for the first time, most users choose their mobile number as their Virtual Private Address (VPA). While the option to choose a username instead has always existed in UPI, most users are unaware of it. With this circular, the username will become the default instead of the mobile number, thereby enhancing privacy.

Disclaimer: This content has been sourced and edited from TV9. While we have made modifications for clarity and presentation, the original content belongs to its respective authors and website. We do not claim ownership of the content.