Under the DPDP framework, exposing mobile numbers or complete identities poses a significant liability, prompting NPCI to consult UPI apps and banks to improve privacy
July 28, 2026 / 13:20 IST
NPCI issues circular to mask customer phone numbers
- NPCI consults on DPDP law implementation for UPI.
- UPI apps must mask phone numbers for user privacy.
- Username-based UPI IDs to become default option.
Did our AI summary help?
[Liked this AI Summary?
Join our AI Workshop](https://go.outskill.com/mastermind-moneycontrol)
The National Payments Corporation of India (NPCI) is holding talks with UPI apps and partner banks on the implementation of the Digital Personal Data Protection (DPDP) law to protect customer privacy, sources told Moneycontrol.
NPCI, which runs UPI, the country's most popular digital payments platform, has already ordered masking of phone numbers.
The UPI ecosystem relies on phone numbers to make and verify payments, which is at once a security feature and a privacy risk.
"However, the DPDP implementation would mean that phone numbers or full names could be a privacy risk, and NPCI is talking to banks and UPI apps to ensure that their systems are ready to understand and fix the roles and responsibilities on each participant," a senior executive with a UPI app told Moneycontrol on condition of anonymity.
Phone numbers to be masked
Last month, NPCI sent a circular asking payment apps to mask customer phone numbers to protect privacy and enhance security, as multiple social media complaints from women users raised concerns about identity, privacy and security.
NPCI has set September 4 deadline for implementing the order.
"UPI member banks and UPI apps should ensure user privacy. Users' information, namely UPI IDs, mobile numbers, and account numbers, must be masked across all customer-facing interfaces and communications of the UPI member Banks and UPI Apps," NPCI said.
Username-based UPI IDs
Only the last four numbers of a customer's mobile number should be visible to the other party. For transactions done through QR codes, the app should not display the mobile number once the payments are done.
UPI apps must allow users to have non-mobile number-based IDs and set it as their default ID, the circular said.
When customers sign up for UPI for the first time, most of the users select their mobile number as their virtual private address (VPA). UPI has always had the option to select a username instead but most users are unaware of this option.
With the circular, the default will be a username instead of a mobile number, thus improving privacy.
Invite your friends and family to sign up for MC Tech 3, our daily newsletter that breaks down the biggest tech and startup stories of the day
Anand J
Discover the latest Business News, Sensex, and Nifty updates. Obtain Personal Finance insights, tax queries, and expert opinions on Moneycontrol or download the Moneycontrol App to stay updated!