The National Payments Corporation of India has directed banks and payment application providers to mask registered mobile numbers on all customer-facing UPI interfaces. Under the directive, only the last four digits of a user's phone number will remain visible to counterparties during transactions.
NPCI's circular requires apps to offer username-based virtual payment addresses as the default choice instead of mobile-number-linked identifiers. The changes align with India's Digital Personal Data Protection Act, which classifies mobile numbers as sensitive personal data.
All participating banks and payment apps, including Google Pay, PhonePe, and Paytm, must complete implementation by September 4, 2026.