The National Payments Corporation of India (NPCI) has introduced new security measures to protect Unified Payments Interface (UPI) accounts linked to inactive mobile numbers, aiming to reduce fraud and identity theft risks associated with recycled phone numbers. The initiative builds upon NPCI’s recent security enhancements, including the implementation of 35-digit alphanumeric transaction IDs set to begin in February 2025.
Under the new requirements, effective March 31, 2025, UPI banks and Payment Service Providers must conduct weekly database updates to identify and remove recycled or churned mobile numbers using the Mobile Number Revocation List (MNRL) or Digital Intelligence Platform (DIP). The measure supports broader regulatory efforts, including the Reserve Bank of India’s mandate for specific phone number series designed to combat digital fraud.
The measures mandate that UPI apps obtain explicit user consent with clear opt-out options for seeding or porting UPI numbers. All communication regarding these processes must be clear, non-intrusive, and free from misleading or forceful messaging. Additionally, consent solicitation cannot occur before or during transactions.
Payment apps are also required to deactivate UPI IDs that have remained inactive for more than one year. Users will receive notifications through SMS, email, or app notifications when their registered mobile numbers require verification or updating. The verification process complements India’s existing digital identity infrastructure, which includes the Aadhaar Enabled Payment System (AePS) that has successfully integrated biometric authentication for digital banking.
“When customers discontinue their mobile numbers, which are later recycled for new users, identity and profile takeover risks emerge,” says TechFini Co-Founder Jai Kumar. “These numbers can pose a risk in financial transactions, leading to misdirected messages, failed transactions, or security breaches.”
The initiative represents part of NPCI’s broader efforts to enhance India’s digital payment security infrastructure. The UPI system has become increasingly central to India’s digital economy, processing billions of transactions monthly across the country. The security update follows several other digital transformation initiatives in India, including the mandatory implementation of e-KYC verification for various government services and financial systems.
Sources: Economic Times, National Herald India, Ricago
Follow Us