NPCI Masks UPI Phone Numbers from 4 September 2026

NPCI's UPI Privacy Directive Takes Effect 4 September 2026

The National Payments Corporation of India (NPCI) set 4 September 2026 as the compliance deadline for a directive requiring all banks and UPI applications to stop displaying customers' full mobile numbers during and after transactions. From that date, Google Pay, PhonePe, Paytm, BHIM, and every other app using UPI as its payment backend must mask the mobile number so that only the last four digits remain visible to the other party in a transaction. The first six digits are replaced with Xs or asterisks on-screen. The requirement applies to all customer-facing interfaces operated by both banks and the third-party UPI apps sitting on top of them.

The directive is not limited to mobile numbers. Account numbers and UPI IDs — technically Virtual Payment Addresses, or VPAs, such as yourname@oksbi — are subject to the same partial-masking requirement. In QR code payment flows, the full mobile number will no longer be displayed to the payer, even after the transaction completes and a confirmation receipt is shown. The combined effect is a significant reduction in the amount of personally identifiable information that passes between transacting parties during a routine UPI payment.

Why NPCI Issued the Directive

The NPCI circular has two reinforcing rationales. The first is regulatory: India's Digital Personal Data Protection Act, enacted in 2023 and progressively brought into force since then, classifies mobile numbers and full names as personal data requiring appropriate technical safeguards. Mobile numbers, when visible in every UPI transaction, function as persistent personal identifiers that are exposed to counterparties the user has no prior relationship with — street vendors, marketplace sellers, or anyone scanning a QR code. The DPDP Act's principles of data minimisation and purpose limitation require that this exposure be curtailed unless the full number is strictly necessary for the transaction, which it is not: UPI routing requires the VPA or account number, not the display of the underlying mobile number.

The second rationale is user safety, and specifically the safety of women transacting digitally. A sustained body of complaints on social media — prominently from women — documented cases where recipients of UPI payments used visible mobile numbers to identify, locate, or contact payers without their consent. The pattern is structurally similar to the doxing risk familiar from other digital platforms: a visible identifier enables unwanted contact by counterparties who were only ever supposed to receive a payment. By reducing visibility to the last four digits, NPCI makes reverse-identification substantially harder without removing the ability for users to confirm they are paying the right person.

The Username-Based Identity Push

The NPCI circular goes further than simple masking. It instructs apps that use UPI as their backend to offer consumers the option to adopt a username-based identity that is not tied to their mobile number. Under this model, a user's UPI-linked identity would be something like a chosen handle rather than a phone-number-derived VPA, and the mobile number would not be part of the identity surface visible to counterparties at all. This aligns with the direction several major UPI apps have already taken: PhonePe introduced user-chosen display names for its network, and NPCI's own BHIM app has piloted non-phone-number VPA creation.

The username shift is a structural change to how India's 650-million-plus UPI user base presents itself on the network. For the majority of users who have used their phone number as their primary UPI identity since they first set up UPI, the transition to a chosen username requires both app-side UI changes and a fresh mental model for how digital payments work. NPCI's directive sets compliance at the UI level and gives apps discretion on implementation timelines for the username feature beyond the masking requirement.

Engineering Implications for Payments Apps and Fintech Teams

For software teams building on the UPI stack — whether consumer apps, B2B payment gateways, or fintech platforms — the NPCI masking directive has several specific implementation requirements. Every screen that renders a counterparty's mobile number in a payment flow must be updated to apply the masking logic. This includes pre-transaction confirmation screens, post-transaction receipts, transaction history views, and any notification payloads that include the recipient's contact information.

The masking requirement extends to QR code generation: if a merchant's UPI QR currently encodes their full mobile number in a scannable format that exposes the number to the payer's device, that encoding must be updated. The challenge here is that many small-merchant QR codes are printed and not dynamically generated — refreshing those requires either a re-printing exercise or a server-side rendering approach where the QR is generated dynamically and the underlying mobile number is never exposed in the scannable data.

For payment aggregators and payment gateway providers operating in India — a category that includes both large platforms like Razorpay and Cashfree and the in-house payment infrastructure of consumer apps — the compliance exercise touches API response formats, webhook payloads, and dashboard displays in addition to the customer-facing UI. Any downstream system that ingests and displays UPI transaction data needs to apply the masking consistently, not just at the point of original data capture.

DPDP Act as the Underlying Framework

The NPCI directive is best understood as one of several technical implementation mandates that flow from the DPDP Act's data minimisation principles. Other sectors and product categories will face similar mandates as the DPDP Act's enforcement framework matures. For fintech and payments teams, the UPI masking directive is an early signal of the compliance engineering workload that the DPDP Act will generate across Indian technology products over the next two to three years. Building privacy-by-design capabilities — masked display, minimised data collection, consent-managed data sharing — into product architecture now reduces the recurring engineering cost of compliance as new mandates arrive.

What This Means for Teams Building on UPI

For product teams in India building consumer or merchant applications on the UPI network, the 4 September 2026 deadline is a forcing function for a privacy engineering investment that should have been part of the original product design. The masking is not a complex technical change in itself — applying a string operation to mask the first six digits of a ten-digit number requires minimal engineering effort. The real effort is the audit: identifying every touchpoint in the product surface where a counterparty mobile number is displayed or transmitted, and ensuring the masking is applied consistently without creating edge cases where the full number leaks in error states, logs, or export flows.

For teams building new payment products on UPI from today, the directive establishes the new baseline: mobile numbers are not part of the user-facing data surface, usernames or VPAs are the appropriate identity layer, and the full number stays within the system boundary. Designing to this standard from the outset is simpler than retrofitting it.

The Bottom Line

NPCI's directive requiring all UPI apps and banks to mask customer mobile numbers took effect on 4 September 2026. Under the rule, only the last four digits of a user's mobile number are visible to the other party in a UPI transaction, with the same masking applied to account numbers and UPI IDs. QR code payment flows are required to omit full mobile numbers from displayed information even on transaction completion. The directive is grounded in India's Digital Personal Data Protection Act and in documented user-safety concerns, particularly for women, arising from visible mobile numbers in payment flows. Apps are also required to offer username-based identities as an alternative to phone-number-linked VPAs. For engineering teams building on the UPI stack, the compliance requirement extends to every data surface — UIs, receipts, webhooks, logs, and QR code formats — where a counterparty mobile number is currently rendered.