India’s payments operator gave every UPI member bank and app until 4 September to mask mobile numbers, UPI IDs and account numbers on customer-facing screens and messages. The order reached a network that processed 24.51 billion transactions worth Rs 29.82 trillion in August.
The deadline has passed. Proof of uniform execution has not arrived with it. That gap matters because a mandate to hide an identifier is not evidence that every search screen, confirmation page, receipt and notification now does so.
The architecture is clearer. A counterparty does not need a payer’s phone number. Banks, payment providers and investigators still need the identity and transaction records behind the payment. The useful question is therefore not whether UPI erased identity. It is whether the network restricted casual exposure without weakening controlled access.
The mandate covers a surface, not an account
TeamLease RegTech’s legal record identifies the instruction as NPCI/UPI/OC-234/2026-27, dated 5 June 2026. It says the circular requires UPI IDs, mobile numbers and account numbers to be masked across customer-facing interfaces and communications by 4 September. Apps must also let a user have a non-mobile-number UPI ID and select it as the default.
Reporting based on the circular’s annexure adds the display detail. Only the final four digits of a mobile number should remain visible when masking applies, while a mobile number should not appear after a QR payment (Moneycontrol).
That second requirement has been easy to overstate. A non-mobile-number UPI ID must be available and selectable as the default. The circular does not say every existing number-based ID must be cancelled or that each new user must be silently assigned a chosen username.
The deadline arrived before the audit
A fresh check on 20 September still found only partial public implementation evidence. Paytm said on 7 September that its current app includes personalised UPI IDs that avoid exposing a mobile number. Google Pay’s current help page says it uses a masked number or UPI ID for transactions involving unknown phone numbers.
That is a named control, not a network audit. PhonePe’s current terms still explain that a mobile number may serve as a UPI Number, while users can hold several VPAs and choose a primary one (PhonePe). That description is compatible with masking at the display layer, but it does not certify every covered interface. NPCI has not published a post-deadline compliance report, and the largest apps have not released screen-by-screen results across all payment paths.
The defensible conclusion is narrow. OC-234 set a network-wide requirement. Public evidence shows relevant controls at two major apps. It does not yet prove uniform implementation.
Fraud teams keep the graph
UPI is not one app talking directly to another. NPCI’s system description identifies the payer’s app and provider bank, the remitter bank, the payee’s provider and the beneficiary bank. A VPA routes across that chain. It is not the customer record.
The underlying data remains inside regulated systems. PhonePe says registration details, including name, mobile number and banking information, are shared with its provider bank and NPCI. Its published participant rules also say NPCI gives banks access to reports, chargeback functions and transaction-status updates. The banks retain account and know-your-customer records.
The fraud layer is explicit. In a 2025 cybercrime report, Parliament’s Home Affairs Committee said NPCI’s Fraud Risk Management system analyses UPI and RuPay transactions in real time, identifies anomalous patterns and alerts member banks. The report also says the system helps find mule accounts and supports NPCI’s work with law enforcement and India’s Financial Intelligence Unit.
Disputes require the same separation between public display and institutional record. NPCI’s settlement process requires members to retain transaction records, keep disputed records until resolution and provide dispute details to other members when requested.
The number should disappear from the receipt, not from the controlled investigation path.
Masking should reduce casual harvesting and post-payment harassment without blinding a bank’s fraud engine. It may also separate a public payment alias from the phone number used for device binding and recovery. OC-234 changes presentation. It does not order deletion of the underlying customer or transaction data.
The registry exists. Interoperability does not
The weakest link is cross-institution tracing after stolen money moves through several banks and mule accounts. Here the public record needs careful chronology.
RBI says it operationalised the Central Payments Fraud Information Registry in March 2020. The reporting module moved to DAKSH on 1 January 2023. Payment providers must validate reports against their systems and submit individual fraud transactions to the registry.
An August 2026 parliamentary committee release nevertheless called the CPFIR “upcoming” and asked that it become a comprehensive, real-time and interoperable fraud-data repository available to banks and other relevant participants.
Read together, the records do not show that India lacks a registry. They show that an operational reporting registry has not yet become the broader coordination layer Parliament wants. The unfinished capability is real-time, multi-participant interoperability for sector-wide analysis and action.
Scale makes that boundary important. Government data counted 554.9 million UPI users, 65 million merchants and 731 banks by June. A display rule can have one deadline. Controlled tracing across that many institutions is a harder systems problem.
The next audit should test both sides. It should check masking across the major apps and banks, including search, QR confirmation, receipts and notifications. It should also measure how quickly an authorised investigator can follow a reported payment across institutions, which fields become visible, who accessed them and when they are deleted.
UPI’s privacy mandate has defined the first test. The public record does not yet show a network-wide pass. On the second test, fraud teams can still see the records inside regulated systems, but the cross-institution identity graph remains unfinished.
Discussion
Sign in to join the discussion.
No comments yet. Be the first to share your thoughts.