UPI Mobile Number Masking: What Changed, and the Part It Doesn't Fix

Short answer: from 4 September 2026, UPI apps must show only the last four digits of your mobile number to the person you pay, and no number at all on QR-code payments. New UPI IDs now default to a username handle instead of your phone number. The masking is automatic and requires nothing from you. But a UPI ID you already have — one built from your phone number — does not close on its own. You have to create a new username-based ID and share only that one.

The misconception

Almost every version of this story calls it a privacy upgrade, in the tone reserved for a settings tidy-up you can safely ignore. Two smaller misreadings ride along with it. The first is that the change is a law. The second, and the more expensive one, is that because the masking is automatic, you are now done.

What actually happened

NPCI directed banks and UPI apps to stop displaying customers’ full mobile numbers during transactions, setting 4 September 2026 as the compliance deadline. Only the last four digits stay visible to the other party. On a QR-code payment, the number is not shown at all, even after the transaction completes. Account numbers and UPI IDs fall under the same masking requirement, and apps were told to make a username-based virtual payment address the default in place of the number-based one.

The reason was not housekeeping. Reporting attributes the directive to complaints — described as coming disproportionately from women users — about safety, harassment and identity exposure caused by phone numbers being visible during payments. The Digital Personal Data Protection Act appears in the coverage as context for the obligations involved, but it is worth being precise about what this instrument is: a directive from NPCI to banks and apps, not a measure passed by Parliament. A directive can be revised or quietly relaxed in a way that an Act cannot.

The part worth sitting with

Your phone number on UPI was never the payment. It was the address the payment was built on.

That was a design decision, not a technical necessity. Making the number double as the public payment identifier is what made UPI frictionless to adopt — you already had the number, so you already had the address. The same property, seen from the other side, is that every payment handed a stranger a live, working contact detail. You pay a vegetable seller, a delivery rider, a shopkeeper you will never see again, and the payment concludes while the number stays behind in their phone.

UPI moved 24.51 billion transactions worth ₹29.82 lakh crore in August 2026 alone, averaging 791 million a day. The exposure was not a bug that slipped through. It was the convenience, working exactly as designed, for roughly a decade, until enough people complained about the other edge of it.

Which is the genuinely creditable part of this story, and it should be said plainly rather than buried under the caveats: the system fixed something, and it fixed it without asking anything of the people it was failing.

The gap

The masking is retrospective in its effect but not in its reach. It changes what is displayed. It cannot recall a number that is already circulating — in an old post, on a printed QR at a shop counter, in a WhatsApp group, on a resale listing.

More immediately: the username default applies to new UPI IDs. If your current ID was generated from your phone number, it keeps your number in it, and it does not close by itself. Every time you share it, you are still handing over the old address.

What to do

1. Create a new username-based UPI ID. On Google Pay you cannot rename an existing one — open Manage UPI IDs under your bank account and add a new custom ID. PhonePe and Paytm both have a create-new-ID flow. Interfaces move around, so check in-app rather than trusting a screenshot.
2. Share only the new one, and stop sharing the old one. You can hold up to four active UPI IDs per linked bank account, so this costs you nothing.
3. Keep the boundary straight. This hides your number. It does not protect your money. If you are worried about UPI fraud, that is a different problem with a different set of defences, and treating this change as fraud protection is how people end up less careful, not more.

One thing still worth verifying yourself: check on your own phone whether your apps have actually shipped the change. The deadline is a date by which banks and apps were told to comply. It is not, by itself, evidence that all of them did.

Your number is your identity. It should not be your receipt.