NPCI’s UPI privacy move sparks wider debate over trust and transparency

MUMBAI: India’s favourite payment app is learning a new trick keeping a little more to itself. The National Payments Corporation of India (NPCI) has moved to mask users’ mobile numbers during UPI transactions, a step aimed at strengthening privacy. But while the change plugs one loophole, it has also reignited a broader debate over how India’s digital payments ecosystem should balance privacy with trust.

The move follows complaints from several UPI users, particularly women, who reported receiving unsolicited phone calls and WhatsApp messages after their mobile numbers became visible during transactions. In response, NPCI has directed banks and UPI apps to hide mobile numbers and other sensitive personal information, displaying only the last four digits.

While the decision is expected to reduce the misuse of personal information, industry observers believe it addresses only one aspect of a much larger privacy challenge.

At the heart of the issue is UPI’s architecture, which is closely linked to users’ mobile numbers and bank accounts. These identifiers have long acted as trust signals, helping users verify the identity of recipients before transferring money.

That becomes particularly important in everyday transactions involving cab drivers, domestic workers, delivery executives, street vendors and local service providers, where names and phone numbers often reassure users that money is reaching the intended recipient.

The latest change therefore creates a delicate balancing act. Greater privacy can reduce harassment and curb the misuse of personal data, but excessive anonymity could make it harder for users to confirm who they are paying, potentially increasing the risk of mistaken transfers and payment fraud.

The shift also aligns with India’s evolving Digital Personal Data Protection (DPDP) Act, which places stricter obligations on organisations handling personal information. Under the new framework, customer identifiers such as mobile numbers and names are increasingly being treated as sensitive personal data requiring stronger safeguards.

As part of the transition, NPCI has also asked UPI platforms to encourage users to adopt username-based UPI IDs instead of payment addresses linked directly to mobile numbers. The objective is to allow users to transact without exposing their phone numbers while preserving the simplicity of digital payments.

Privacy advocates, however, argue that masking phone numbers alone does not fully resolve concerns around identity exposure, profiling and data sharing within the broader payments ecosystem. Questions remain over how much personal information should be visible during transactions and where responsibility for protecting that data ultimately lies.

The debate carries added significance because of UPI’s enormous scale. With hundreds of millions of users relying on the platform for everything from shopping and utility bills to person-to-person transfers, even small changes to the user experience can have far-reaching implications.

For now, hiding mobile numbers marks an important first step in strengthening user privacy. But as India moves towards stricter data protection standards, the real challenge will be designing a payments ecosystem that protects personal information without weakening the confidence and convenience that helped make UPI a global digital payments success story.