India's UPI story is often told through consumer apps such as PhonePe, Google Pay, Paytm and BHIM. Every month, headlines celebrate new transaction records, merchant adoption and digital payment milestones.
But there is another story unfolding behind the screens.
The biggest long-term winners may not be the apps consumers use every day. They are the companies building the invisible infrastructure that makes every QR scan, fraud check, merchant settlement and lending decision possible.
UPI processed 23.2 billion transactions worth Rs 29.9 trillion in May 2026, a record, before easing to 22.72 billion in June, according to NPCI data. Daily volume now averages around 757 million payments. For the full year FY 2025-26, UPI cleared 241.62 billion transactions worth Rs 314 lakh crore, up 30 percent by volume. India already handles close to half of the world's real-time payments.
Here is the twist most coverage misses. The apps doing all that scanning, PhonePe and Google Pay chief among them, collect no merchant discount rate on standard UPI payments. Zero MDR has been policy since 2020. So the household names sit on massive volume and thin margins, while a quieter set of players turns each scan into revenue.
These are the hidden winners of the UPI boom. They rarely appear on a consumer's phone, and that is exactly why they profit.
The apps run the rails, but barely touch the toll
The duopoly numbers explain the pressure. In May 2026, PhonePe held 46.2 percent of UPI volume and Google Pay 32.7 percent. Their combined share slipped below 80 percent for the first time as BHIM, Navi and super.money crept up. An NPCI rule capping any single app at 30 percent is due on December 31, 2026.
So the largest apps face a hard math problem. More volume does not mean more transaction revenue, and a market-share cap limits how big any one of them can get. To make money, they have to sell something on top of the payment.
That "something" is where the ecosystem's profit has quietly relocated.
Also Read | The New Indian Middle Class: How Digital India, UPI and Quick Commerce Are Changing Consumer Behaviour
Winner one: the soundbox and QR hardware makers
Walk into any kirana store and you will hear it. "Payment received, five hundred rupees." That small speaker, the soundbox, is the single most profitable object in the UPI story.
Deployed soundboxes rose from about 9 million in 2023 to roughly 20 million by 2024, with projections to more than double by 2029, per ecosystem research cited by the Level One Project. Paytm alone has pushed past 8.5 million devices. PhonePe has deployed more than 2 million, BharatPe close to a million, and Google Pay entered the segment with its SoundPod.
The economics are the point. A soundbox costs roughly 18 to 20 dollars to build, then earns a recurring monthly subscription for years. A Bank of America Securities note pegged Paytm's soundbox EBITDA margin near 60 percent. This is a hardware-plus-subscription business hiding inside a payments app, and it prints cash while the underlying UPI transaction earns nothing.
Most of these devices are now made in India, which pulls contract manufacturers, chipset suppliers and firmware teams into the winners' circle too. The customer base is enormous. India has 40 to 45 million merchants, and only a fraction own a device today.
Winner two: the lending rails underneath the scan
Every UPI payment leaves a trail. That trail is turning into collateral.
A merchant with a soundbox generates a clean, verifiable record of daily cash flow. Lenders read that record to underwrite loans they would never have touched a decade ago. Paytm's merchant lending business alone booked around Rs 900 crore in revenue in the first half of FY26, and its loan sizes rise for merchants who own a device.
The plumbing behind this is the Account Aggregator framework, overseen by industry body Sahamati. It had linked more than 15 million accounts, logged over 16 million consents, and signed up 390-plus participants, letting borrowers share bank data with one tap instead of a stack of PDFs. Sitting alongside it is OCEN, the Open Credit Enablement Network, which standardises how lenders, apps and aggregators talk to each other.
None of these names sell anything to a consumer. They sell rails to banks and NBFCs. Credit-on-UPI, cash-flow underwriting and embedded loans all ride on this infrastructure, and the toll is collected by the companies that own the pipes, not the app that shows the loan offer.
Also Read | NPCI Is Changing How You See a UPI Recipient Before You Pay
Case Study: Merchant Credit Through Digital Payments
Several fintech lenders now provide working capital loans within minutes using transaction data collected through merchant payment systems.
A grocery shop receiving hundreds of UPI payments every day creates a digital business profile.
That profile often becomes more useful than paper documentation.
Infrastructure companies providing APIs, underwriting engines and embedded lending technology are therefore becoming essential partners for banks and NBFCs.
The payment generates the data. The data generates the loan. The loan generates the revenue.
Winner three: the fraud detection and risk layer
Scale invites crime. As volume climbed, so did loss.
UPI-linked fraud rose to about 6.32 lakh cases worth Rs 485 crore in FY 2024-25, according to figures compiled from RBI and NPCI reporting. In FY 2025-26 up to November, cases had already climbed to roughly 10.64 lakh, worth about Rs 805 crore. The RBI's 2024 annual report tracked over Rs 1,457 crore lost to digital payment fraud in a single year.
Old rule-based systems cannot keep up when a transaction settles in under a second. That gap created a market. NPCI's MuleHunter AI has flagged more than 4.7 lakh suspected mule accounts, and its FIMI dispute-resolution model now serves over a million users. Around these public tools, a layer of private RegTech firms sells real-time scoring, behavioural analytics and biometric checks to banks and fintechs.
NPCI chief Dilip Asbe made the direction plain at Mumbai Tech Week 2026. He said AI will be central to pushing UPI from 750 million to a billion daily transactions, and named fraud detection, credit distribution and voice onboarding as the three levers. Every one of those levers is a software contract, and every contract is revenue for a firm you have never scanned with.
Also Read | EPFO New Rules 2026: Now Withdraw Your PF Money via UPI and ATM - Just Like a Bank Account
Winner four: the analytics turning scans into scores
Sitting across all three is the analytics layer. Cash-flow data from soundboxes, consented bank data from Account Aggregators, and transaction patterns from fraud engines feed models that decide who gets a loan, at what rate, in how many seconds.
Asbe has argued that Indian firms should build small, sharp language models trained on the country's financial data. That is a direct pitch to analytics and data-science companies. In a market where the payment is free, the insight drawn from the payment is the product being sold.
The News4Bharat POV
Our reading is simple. Bet on the pipes, but price in the regulator.
The value has moved down the stack, but "hidden" does not mean "safe." Three things temper the story.
Concentration is following the money downward. The same handful of names, Paytm, PhonePe, Pine Labs and a few banks, sit across soundboxes, merchant lending and risk tools at once. The 30 percent cap fixed the app-level duopoly. Nobody is yet watching for a duopoly in the infrastructure layer, where switching costs for a merchant are far higher than swapping one payment app for another.
The data is both the crown jewel and the liability. Whoever controls the cash-flow record and the consent layer controls underwriting, and that is real power. It is also a target, for fraudsters chasing mule accounts and for regulators enforcing the DPDP Act. The winners of the next phase will be the firms that treat data governance as a product feature, not a compliance chore.
The road ahead: 2026 to 2028
The next two years hand the infrastructure players their biggest tailwinds yet.
The 30 percent cap lands on December 31, 2026. It forces a reshuffle at the app layer and opens room for BHIM, Navi and super.money. The infrastructure firms do not care which app wins. They sell to all of them, so a more fragmented app market can mean more customers, not fewer.
Credit Line on UPI becomes the swing product. Pre-sanctioned credit now fires at the point of payment, and the RBI has widened access to small finance banks. The unlock here is regulatory clarity, not new technology. Whenever it arrives, the Account Aggregator network, OCEN and the loan service providers become the pick-and-shovel trade behind every embedded loan.
