The National Payments Corporation of India (NPCI) has directed all banks and UPI applications to mask customers' full mobile numbers during transactions, with a compliance deadline set for September 4, 2026. Under the new rules, only the last four digits of a registered mobile number will be visible to the other party, while the rest will be concealed. This move aims to enhance user privacy and security during digital payments, according to medianama.com.
This directive follows a recent NPCI circular responding to social media complaints, particularly from women, about safety and identity theft risks linked to visible phone numbers during UPI transactions. The masking applies not only to on-screen displays during transactions but also to QR code payments, where full mobile numbers will no longer be shown even after payment completion. Additionally, account numbers and UPI IDs (Virtual Payment Addresses or VPAs) must be masked on customer-facing screens, ensuring sensitive information is not fully exposed.
NPCI is also pushing for a shift away from mobile-number-based UPI IDs. Many new users currently select number-based VPAs without realizing the availability of username-based alternatives. The regulator has instructed apps to set username-based VPAs—such as a chosen name combined with the bank handle—as the default option for new users. This change reduces the risk of phone numbers being linked directly to payment identities, aligning with broader efforts to strengthen privacy in India’s digital payment ecosystem.
The deadline for banks and UPI apps to implement these masking requirements is September 4, 2026, marking a significant step in protecting user data during digital transactions, medianama.com reports.