The National Payments Corporation of India has directed all UPI-enabled applications and banks to mask users' mobile numbers during transactions. This new policy, which requires full implementation by September 4, aims to enhance user privacy by displaying only the last four digits of a recipient's phone number. The move is part of a broader effort to align digital payment practices with the requirements of India's Digital Personal Data Protection Act. By limiting the exposure of personal identifiers, the NPCI seeks to reduce the risk of data misuse and unsolicited contact that some users have reported after completing payments.
In addition to masking phone numbers, the NPCI is pushing for the adoption of username-based UPI IDs as the default for new users. This shift is designed to allow individuals to conduct financial transactions without revealing their primary mobile numbers, which have traditionally served as the core identifier in the UPI ecosystem. The change reflects a growing emphasis on data security within the country's rapidly expanding digital economy, where millions of daily transactions rely on the Unified Payments Interface.
This policy change addresses long-standing privacy concerns regarding the visibility of sensitive personal information during peer-to-peer and merchant payments. While the transition is expected to improve security, it also marks a significant change in how users verify the identity of those they are paying. As the September deadline approaches, payment platforms are working to update their interfaces to ensure compliance while maintaining the ease of use that has made UPI a cornerstone of India's digital infrastructure.