From September 4, 2026, UPI member banks and UPI apps must mask mobile-number-based UPI IDs, mobile numbers and account numbers on customer-facing screens and communications, with only the last four digits visible where the NPCI masking format applies. Apps must also allow users to create a UPI ID that is not based on their mobile number and set it as the default.
UPI privacy rules are set to change how personal information appears during digital payments. Under new directions issued by the National Payments Corporation of India, UPI member banks and payment apps will have to mask mobile numbers, account numbers and mobile-number-based UPI IDs across covered customer-facing screens and communications.
For users, this means a phone number that was earlier visible as part of a UPI ID may no longer appear in full during a payment or transaction-related interaction.
What Is Changing in UPI From September 4, 2026?
A UPI payment can reveal more information than many users realise. In several UPI setups, the payment address itself may contain a person's mobile number, such as a number followed by an app or bank handle. A payment confirmation screen, transaction history or other customer-facing record may also show a mobile number or account details.
NPCI is now asking the UPI ecosystem to reduce that exposure.
In a circular dated June 5, 2026, NPCI told all UPI member banks and UPI apps that UPI IDs, mobile numbers and account numbers must be masked across customer-facing interfaces and communications. The accompanying format says that where a UPI ID contains a mobile number, only the last four digits should remain visible. The rest must be masked. The same last-four-digit approach applies to mobile numbers and account numbers.
The implementation deadline is September 4, 2026.
There is a second part to the rule that may have a longer-term effect on how UPI identities are created. UPI apps must allow users to have UPI IDs that are not based on mobile numbers and give them the option to make those IDs their default.
That distinction matters. The rule is about reducing the display of personal information. It does not say that a mobile-number-based UPI address must automatically be cancelled.
What Happened?
NPCI issued UPI Operating Circular No. 234 for FY 2026-27, titled “Safeguarding User Information in UPI”, on June 5, 2026.
The circular is addressed to all UPI member banks and UPI apps.
NPCI states that organisations providing customer-facing UPI services are responsible under applicable laws for protecting user privacy. It then sets out two requirements.
First, UPI IDs, mobile numbers and account numbers must be masked across customer-facing interfaces and communications.
Second, UPI apps must allow customers to create non-mobile-number-based UPI IDs under applicable UPI guidelines and set such an ID as their default.
Banks and UPI apps have until September 4, 2026 to make the required changes.
NPCI's official UPI circulars page currently lists OC No. 234 under FY 2026-27 as “Safeguarding User Information in UPI.”
Also Read | UPI Lite, Credit Lines and RuPay Credit Cards Explained
What Does NPCI's Official UPI Privacy Circular Say?
The annexure to the circular gives the clearest explanation of what users are likely to see.
1. Mobile-number-based UPI IDs
If the UPI ID contains a mobile number, only the last four digits should remain visible. The earlier digits must be masked.
In practical terms, an address structured around a mobile number could appear in masked form rather than displaying the full number.
2. Mobile number
Where a mobile number appears in a covered customer-facing interface or communication, only its final four digits should remain visible.
3. Account number
The same principle applies to account numbers. Only the last four digits should be visible, with the remaining digits masked.
This is broader than changing the format of one UPI ID.
NPCI uses the words “all customer-facing interfaces and communications”, making the direction relevant to the places where a bank or payment app displays these details to customers.
Will Your Mobile Number Disappear From Your UPI ID?
Not necessarily.
This is where the September 4 rule needs to be read carefully.
NPCI has not said that every existing mobile-number-based UPI ID must be deleted or replaced on September 4.
Instead, the circular says that when a UPI ID contains a mobile number and is displayed on a covered customer-facing interface, the mobile-number portion must be masked according to the specified format.
The circular separately requires apps to let users have a non-mobile-number-based UPI ID and set it as their default.
Why Is NPCI Making This Change?
The issue is simple: a mobile number is not just a payment identifier.
It is also used for calls, messaging apps, account recovery, banking alerts and other digital services. When the same number is exposed through routine payment interactions, information originally needed for account registration can become visible to another party.
The UPI system was designed around a Virtual Payment Address so that users did not need to share bank account numbers and IFSC codes with every person they paid. NPCI itself describes the virtual address as one of the ways UPI reduces the need to enter bank credentials during payment.
A UPI ID built directly from a mobile number can partly weaken that privacy benefit because the identifier itself can disclose another piece of personal information.
The June circular addresses that gap.
The Ministry of Electronics and Information Technology says the Digital Personal Data Protection Act, 2023 was enacted on August 11, 2023 and the final Digital Personal Data Protection Rules, 2025 were notified in November 2025 with a phased implementation schedule.
However, an important point should be kept clear: NPCI's June 5 circular itself does not name the DPDP Act in the text reviewed by News4Bharat. It refers more generally to responsibilities under applicable laws.
Separate reporting has linked NPCI's discussions with banks and UPI apps to preparation for India's data protection framework.
For a detailed explanation of the data protection framework, read News4Bharat's guide:
India's DPDP Act Explained: Rights, Rules and Deadlines
Who Is Affected by the September 4 UPI Rule?
UPI users
People whose UPI IDs contain their mobile numbers are the most visible group affected.
Their number-based UPI ID may still exist, but the number should not continue to be displayed in full on covered interfaces after implementation.
Users should also get access to a UPI ID that does not use their mobile number.
UPI apps
Apps providing a UPI customer interface must change the way user information is displayed and provide the non-mobile-number UPI ID option required by NPCI.
The requirement is not limited to one brand.
Banks
UPI member banks must also update customer-facing interfaces and communications covered by the circular.
Merchants
Merchants may notice less customer information appearing in payment records or screens provided through UPI systems.
Secondary reporting on the implementation has said that customer mobile numbers should not continue to appear after QR-based payments and that only the final four digits should remain visible where masking applies.
The NPCI circular itself should remain the primary source when interpreting the final requirement.
What Changed From the Previous Position?
Non-mobile-number UPI IDs are not a new invention.
UPI has long supported virtual payment addresses that do not necessarily have to use the customer's phone number.
Even NPCI's BHIM page currently describes a privacy feature that allows a user to disable a mobilenumber@upi ID when a secondary UPI ID has been created.
What changes with OC-234 is the scale of the requirement.
Previously, privacy could depend on the app, the UPI ID selected by the user and the way a particular interface displayed information.
NPCI has now issued an ecosystem-level instruction covering UPI member banks and UPI apps.
Before the September 4 deadline
A customer could have:
- a UPI ID containing a mobile number
- another UPI ID based on a name or other permitted identifier
- different privacy behaviour depending on the app or bank interface
Under the new requirement
NPCI says:
- UPI IDs must be masked where required
- mobile numbers must be masked
- account numbers must be masked
- only the last four digits should remain visible under the prescribed masking format
- apps must allow non-mobile-number-based UPI IDs
- users must be able to set such an ID as default
This moves the issue from an app-level privacy choice towards a common UPI operating requirement.
Practical Impact: What Could Change on Your Phone?
Consider a user whose current UPI address contains the person's mobile number.
Today, that identifier may appear in a transaction screen, account profile, payment confirmation or another app interface depending on the provider.
After implementation of NPCI's circular, a covered display of a mobile-number-based UPI ID should show the number in masked form, retaining only the final four digits.
If the user creates a non-mobile-number UPI ID, the address itself can avoid exposing the phone number.
You should not need to change your bank-linked mobile number
The circular is about the information displayed to customers. It does not say users need to remove the mobile number registered with their bank.
Mobile verification remains part of how UPI accounts are registered and linked.
Your UPI PIN does not change because of this rule
The privacy circular does not remove the UPI PIN or change the standard authentication process.
For a separate explanation of the latest authentication, biometric and transaction-limit rules, read: UPI Rules 2026: What RBI and NPCI Changed
Your existing UPI ID may continue to work
Nothing in OC-234 says that all mobile-number UPI IDs stop working on September 4.
The key requirement is how information is displayed and the availability of a non-mobile-number-based alternative.
Does the New UPI Privacy Rule Prevent Fraud?
No.
Masking a mobile number reduces unnecessary exposure of user information. It does not stop every type of UPI fraud.
A fraudster can still try to obtain a UPI PIN, persuade a user to approve a collect request or transaction, send a false payment screenshot, misuse screen-sharing software or impersonate a bank employee.
Privacy controls and fraud controls solve different problems.
News4Bharat has also been tracking changes to recipient-name verification, payment limits, biometric approval and other UPI rules.
For the wider regulatory picture:
UPI Merchant Charges Explained: Who Pays MDR in 2026?
UPI Lite, Credit Lines and RuPay Credit Cards Explained
Will UPI Payments Become Chargeable?
These internal links should be placed contextually inside the published article rather than collected only at the bottom. That gives readers a clear path through the News4Bharat UPI cluster.
What UPI Users Should Check After September 4?
The immediate September 4 change is easy to see. A mobile number that was displayed in full may instead appear with most digits hidden.
The more important change may take longer.
UPI began with the idea that a virtual payment address could stand between a customer's bank account and the person receiving the payment. Users did not have to hand over an account number and IFSC code every time they wanted to receive money.
But when the virtual address itself became a mobile number followed by a UPI handle, one piece of personal information remained visible.
NPCI's June circular starts separating those two functions.
A mobile number can remain necessary for registration, bank records, device verification and account-related communication without also serving as the identifier shown during every payment interaction.
If banks and payment apps make non-mobile-number UPI IDs easy to create rather than hiding them deep inside account settings, the change could alter what Indians understand a UPI address to be.
What Happens Next?
The date to watch is September 4, 2026.
By then, UPI member banks and UPI apps are required to make the necessary changes to customer-facing interfaces and communications.
Users should watch for three things after the deadline:
Whether their mobile number is still being displayed in full during UPI-related interactions.
Whether a mobile-number-based UPI ID is shown in masked form.
Whether their UPI app provides a clear option to create and select a non-mobile-number-based UPI ID.
NPCI's circular page should also be checked for any addendum, extension or implementation clarification issued before or after September 4.
As of the August 26, 2026 reporting cut-off used for this article, the September 4 deadline remains the date stated in OC-234 in the sources reviewed by News4Bharat.
Methodology
News4Bharat reviewed NPCI's June 5, 2026 circular on safeguarding user information in UPI and its masking annexure, NPCI's UPI circular index, NPCI product information, Finance Ministry data placed before Parliament, the Government's August 2026 UPI review and MeitY material on India's data protection framework. Primary documents were used for the rule, date, masking format and transaction data wherever available. Secondary reporting was used only to add implementation context and has not been treated as a substitute for NPCI's circular. The regulatory and data cut-off for this article is August 26, 2026.