The National Payments Corporation of India (NPCI) is working with banks and Unified Payments Interface (UPI) apps to mask users’ phone numbers across customer-facing interfaces, in a move aimed at strengthening privacy and ensuring compliance with India’s Digital Personal Data Protection (DPDP) Act. The proposal seeks to reduce the exposure of mobile numbers during UPI transactions, making it harder for fraudsters and unauthorized parties to access personally identifiable information.
NPCI has already issued a circular to banks and payment service providers, and discussions are underway with major UPI apps on implementing the changes in a standardized manner. The initiative builds on earlier privacy guidelines that require sensitive customer information—including mobile numbers, UPI IDs, and bank account numbers—to be masked wherever possible in user interfaces.
NPCI Pushes for Phone Number Masking Across UPI
Under the proposed framework:
- Mobile numbers displayed during UPI transactions would be partially masked.
- Banks and third-party UPI apps would update their interfaces to limit the visibility of personal information.
- The objective is to reduce unnecessary exposure of customer identities while preserving a smooth payment experience.
The proposal reflects growing regulatory attention on data minimization and privacy as UPI continues to scale rapidly across India.
Proposal Snapshot
| Item | Details |
|---|---|
| Initiative | Phone number masking on UPI |
| Led By | National Payments Corporation of India (NPCI) |
| Stakeholders | Banks, UPI apps, payment service providers |
| Objective | Improve customer privacy and reduce exposure of personal information |
| Regulatory Driver | Digital Personal Data Protection (DPDP) framework |
Why NPCI Wants to Mask Phone Numbers
Today, many UPI applications display the sender’s or recipient’s registered mobile number during payment confirmation or transaction history.
According to NPCI, exposing complete phone numbers creates several risks:
- Easier identification of users by unknown parties.
- Increased phishing and social engineering attacks.
- Higher risk of spam and unsolicited contact.
- Greater compliance challenges under India’s evolving data privacy regulations.
Masking phone numbers would limit the amount of personally identifiable information visible during routine transactions while still allowing users to verify payment recipients.
DPDP Act Driving Privacy Changes
The initiative is closely aligned with the Digital Personal Data Protection (DPDP) Act, which emphasizes responsible handling of personal information.
The framework encourages organizations to:
- Collect only necessary personal data.
- Limit unnecessary disclosure.
- Protect customer identities.
- Strengthen safeguards against misuse of personal information.
For digital payment platforms handling millions of transactions daily, minimizing the visibility of customer data is becoming an important compliance requirement.
Expected Benefits
| Benefit | Impact |
|---|---|
| Improved Privacy | Reduced exposure of users’ mobile numbers |
| Better Security | Lower phishing and impersonation risks |
| Regulatory Compliance | Supports DPDP data protection requirements |
| Consumer Trust | Stronger confidence in digital payment platforms |
Industry Discussions Underway
NPCI is consulting with:
- Banks.
- Third-party UPI application providers.
- Payment service providers.
- Technology partners.
The discussions are focused on ensuring that privacy improvements remain interoperable across the UPI ecosystem without affecting transaction speed or user experience.
The move follows several recent initiatives by NPCI to modernize UPI, including proposals for offline NFC-based payments and new checkout experiences, highlighting the organization’s broader effort to improve both security and usability.
What Will Change for Users?
If implemented, users are unlikely to experience major changes in how they make payments.
Instead, they may notice:
- Partially hidden phone numbers during transactions.
- Less personal information displayed in payment confirmations.
- Better protection against identity-based fraud.
- No change to core UPI payment functionality.
The proposal focuses on improving privacy without altering how customers send or receive money through UPI.
Looking Ahead
NPCI’s proposal to mask phone numbers represents another important step in strengthening privacy across India’s rapidly expanding digital payments ecosystem. As UPI adoption continues to grow, reducing the exposure of personally identifiable information is becoming increasingly important to protect users from phishing, identity misuse, and other forms of cyber fraud while aligning payment systems with the requirements of the Digital Personal Data Protection framework.
Looking ahead, the success of the initiative will depend on coordinated implementation by banks and UPI app providers. If adopted across the ecosystem, phone number masking could become a standard privacy feature for digital payments in India, reinforcing user trust while supporting NPCI’s broader efforts to make UPI more secure, privacy-focused, and resilient as transaction volumes continue to reach record levels.
Get the day’s top stories in your inbox
One concise email. No spam, unsubscribe anytime.
