NPCI Mandates UPI Phone Number Masking to Enhance User Privacy

Published August 1, 2026 at 12:33 AM UTC

Authored by

Key Points

NPCI mandates UPI apps and banks to mask customer phone numbers by September 4, 2026.
Only the last four digits of mobile numbers will be visible during transactions.
Users can create non-mobile number-based UPI IDs and set them as defaults.
The move aligns with India's Digital Personal Data Protection laws to enhance user privacy.

Background History

The National Payments Corporation of India (NPCI) is the organization responsible for overseeing the development and implementation of payment and settlement systems in India. In recent years, NPCI has introduced several measures to enhance the security and privacy of digital transactions, including guidelines for masking sensitive user information during UPI transactions.

The National Payments Corporation of India (NPCI) has mandated that all Unified Payments Interface (UPI) applications and partner banks mask customer phone numbers by September 4, 2026. This directive aims to bolster user privacy by concealing sensitive information during transactions. Under the new guidelines, only the last four digits of a user's mobile number will be visible to recipients, while the full number remains hidden. Additionally, UPI apps are required to provide users with the option to create non-mobile number-based UPI IDs, allowing them to set such IDs as their default. This shift from mobile-number-centric identifiers to username-based IDs aligns with India's Digital Personal Data Protection laws, enhancing data security and user confidentiality. The implementation deadline for these changes is September 4, 2026.