The National Payments Corporation of India (NPCI) is implementing comprehensive changes to enhance user privacy in digital payments through UPI applications. According to reports from Moneycontrol, the initiative comes as the Digital Personal Data Protection (DPDP) Act reshapes how organisations handle personal data, with mobile numbers and full names increasingly viewed as sensitive information. The move addresses growing concerns about privacy exposure during digital transactions.
The privacy enhancement comes after a surge of complaints, particularly from women users raising concerns about harassment, identity exposure, and personal safety. As reported by Moneycontrol, many UPI apps currently display a user's full name or registered mobile number during transactions, exposing sensitive personal details. Following these complaints, NPCI issued a circular instructing payment apps to mask registered mobile numbers to protect user privacy and strengthen data security across the ecosystem.
According to Moneycontrol reports, payment apps have been given until September 4 to implement these changes. Under NPCI's circular, customer-facing interfaces on banks' and UPI apps will be required to mask sensitive information such as UPI IDs, mobile numbers, and account numbers. The changes will require banks and payment service providers to update their systems to comply with the DPDP Act and NPCI's privacy expectations. The NPCI has stressed that UPI member banks and apps must ensure user privacy by masking information across all customer-facing interfaces and communications.
A significant change involves the Virtual Payment Address (VPA), which is the unique UPI ID used to send and receive money. While UPI has always allowed users to choose a username-based VPA, many first-time users end up selecting their registered mobile number because they are unaware of the alternative. As reported by Moneycontrol, NPCI now wants UPI apps to make a username-based VPA the default choice instead of a mobile number-based one. This change is expected to significantly improve user privacy by reducing the visibility of phone numbers during transactions. The circular also mandates UPI apps to allow users to have non-mobile number-based IDs as their default ID, representing a major shift in UPI's user privacy policy.
Under the new guidelines, only the last four digits of a user's mobile number should be visible to the other party, while mobile numbers should not be displayed after payments made through QR codes. The changes aim to improve privacy without affecting the speed or convenience of digital payments, ensuring that users can maintain their personal information security while continuing to use UPI services effectively. The NPCI has laid down specific guidelines for transaction visibility, ensuring that sensitive information remains protected throughout the payment process.
