UPI is becoming a major privacy risk for users

India’s Unified Payments Interface (UPI) has revolutionised digital payments, making transactions faster and more convenient than ever. But alongside this success lies a growing privacy concern that often goes unnoticed: the ease with which a simple payment can expose a user’s personal information.

The issue became evident when my niece began receiving WhatsApp messages from strangers after paying auto-rickshaw drivers and small merchants via UPI. Some messages were harmless, others intrusive. What should have been a routine payment unexpectedly revealed her mobile number—and in some cases, her name—to people she had never intended to interact with beyond a single transaction.

This highlights an overlooked flaw in India’s digital payments ecosystem. During UPI transactions made through apps such as Google Pay, Paytm or PhonePe, merchants may gain access to customers’ names and, in certain situations, their phone numbers. While this information is meant to facilitate payments, it can also be misused for unsolicited calls, WhatsApp messages, social media searches or even harassment.

Privacy is not optional

India’s Digital Personal Data Protection Act, 2023, is founded on a simple principle: personal data belongs to the individual. Organisations collecting such information are expected to use it only for the purpose for which it was obtained, with consent and strict purpose limitation at the core of the law.

Yet in practice, personal information is often treated as a commercial asset rather than a responsibility. A payment meant to complete a transaction can unintentionally become an invitation for unwanted contact.

What payment platforms should do

As UPI adoption continues to surge, payment providers must strengthen privacy protections rather than focus solely on transaction volumes. Some practical measures include:

• Mask customer phone numbers from merchants wherever possible.
• Display only the minimum information required to complete a transaction.
• Introduce user IDs or aliases instead of revealing personal mobile numbers.
• Provide a simple mechanism to report harassment linked to UPI payments.
• Use temporary communication channels when merchant-customer contact is genuinely required.
• Maintain audit trails to investigate misuse of customer data.
• Educate merchants about their legal obligations under data protection laws.

Consumers also need to stay vigilant

Users can reduce risks by reviewing privacy settings in payment apps, limiting the personal information displayed on their profiles, considering a separate mobile number for digital payments and promptly blocking and reporting anyone who misuses their contact details.

Most importantly, consumers should reject the notion that such privacy breaches are simply “part of the system.” Normalising misuse of personal data only weakens trust in digital payments.

Trust is UPI’s biggest asset

UPI’s greatest achievement is not just speed or convenience—it is public trust. That trust depends on users believing that their personal information is protected as carefully as their money.

A customer paying for a taxi ride should not unknowingly become accessible to strangers. A QR code should complete a transaction—not compromise privacy.

In the digital economy, trust is the real currency. Money should reach the merchant. A customer’s phone number should not.