Will UPI data become safe just by masking the number? Why is this solution to privacy incomplete?

National Payments Corporation of India (NPCI) is in talks with UPI apps and partner banks about implementing the Digital Personal Data Protection (DPDP) law to protect customer privacy. NPCI, which runs the country’s most popular digital payment platform UPI, has already ordered masking of phone numbers. The UPI ecosystem relies on phone numbers to make and verify payments, which is both a security feature and a privacy risk at the same time.

However, implementing DPDP would mean there could be risks to phone number or full name privacy, and NPCI is talking to banks and UPI apps to ensure their systems are in place to understand and fine-tune the roles and responsibilities of each participant, a senior executive at a UPI app told Moneycontrol on condition of anonymity.

phone numbers will be masked

Last month, NPCI had sent a circular to payment apps to mask customers’ phone numbers to improve privacy protection and security after several complaints on social media from women users raised concerns about identity, privacy and security. NPCI has set a deadline of September 4 to implement this order.

NPCI said that UPI member banks and UPI apps should take care of user privacy. Users’ information, such as UPI ID, mobile number and account number, must be masked in all customer-facing interfaces and communications of UPI member banks and UPI apps.

Username-Based UPI ID

The other party should see only the last four digits of the customer’s mobile number. For transactions made through QR code, the app should not show the mobile number after payment is made. The circular states that UPI apps should allow users to have an ID other than the mobile number based ID and set it as their default ID.

When customers sign up for UPI for the first time, most users choose their mobile number as their Virtual Private Address (VPA). UPI has always had the option to choose a username instead, but most users are not aware of this option. With this circular, username will be the default instead of mobile number, which will improve privacy.