With an emphasis on enhancing security and preventing financial fraud, the National Payments Corporation of India (NPCI) has announced new rules for the Unified Payments Interface (UPI). From April 1, mobile numbers associated with UPI accounts which have remained unused for a long time will be deleted from bank registers. The scheme could impact different users as they may see their UPI accounts suspended for a while if they fail to update their records within the desired time.
What Are the New UPI Guidelines?
The NPCI, which operates UPI and other retail payment systems in the country, has directed banks and payment service providers (PSPs) such as Paytm, Google Pay, and PhonePe to flag and de-link dormant mobile numbers that are connected to UPI accounts. The new rule will protect customers from cybercrime and unauthorised transactions that are possible when recycled or old numbers are still linked to active bank accounts.
This is in the wake of a prior directive that required banks and PSPs to update customer mobile number records weekly. Now, as the enforcement of this regulation is becoming more stringent, customers who have outdated mobile numbers linked with their UPI accounts can expect their online transactions to be affected.
Who Will Be Affected?
The new regulations directly impact three categories of users:
Individuals who have changed their mobile numbers but not informed their banks: If the old mobile number of a customer is still linked to his/her bank account but is not in use, it may be disconnected from UPI services post-March 31.
Inactive or recycled users whose numbers are still associated with UPI: Numbers that have been inactive for a long time could be automatically delinked, preventing users from initiating UPI transactions.
Those who have lost their mobile SIMs without modifying their bank details: If an abandoned number is still registered under UPI transactions, it may be a possible security risk and be removed.
How Will This Impact UPI Transactions?
If a user's mobile number is removed from UPI accounts due to inactivity, it could cause disconnections in electronic payments, such as:
Not able to initiate or receive UPI transactions.
Logins to UPI apps like Google Pay or PhonePe would fail.
Must re-register UPI services through an active mobile number mapped against their bank account.
Inactive numbers can lead to loopholes in security and consequently, fraud opportunities. Inactive numbers can be misused by criminals for unlawful transactions if the numbers are being reused by other users. The NPCI guideline is designed to minimise such vulnerabilities and enable only active, verified users to utilise UPI services.
How Will Banks and PSPs Enforce This Rule
In preparing for the implementation of such new rules, banks and PSPs were mandated to update their databases before March 31. Two of the most powerful tools will be used for that matter:
Mobile Number Revocation List (MNRL): It is a digitally signed list of permanently blocked mobile numbers, procured from the telecom service providers and published every month on the Telecom Regulatory Authority of India (TRAI) website. The banks and PSPs will use this list to flag and de-activate dormant numbers relating to UPI accounts.
Digital Intelligence Platform (DIP): It is an integrated platform which facilitates the sharing of data among digital platforms, law enforcement organisations, financial entities, and telecommunication operators in real-time. It will help in tracking idle numbers and take them out from UPI databases in a timely manner.
Steps to Prevent UPI Disruptions Post-March 31
To prevent any issues in UPI transactions, users must execute these steps before April 1:
Maintain the mobile number linked with UPI active: If a number is inactive, users need to make it active or update their bank details with an active number.
Update bank records to the new mobile number: People who have changed their numbers must visit their banks or use mobile banking services to update their records so that they won't lose their UPI services.
Why Is This Change Necessary?
UPI has become the backbone of India's digital payments ecosystem, processing billions of transactions each month. But with the rapid increase in digital transactions, fraud cases have also grown. Cyber attackers prefer to use inactive, unlinked, or dormant mobile numbers for unauthorised bank account access. By keeping active numbers linked only to UPI accounts, NPCI is looking to enhance security and build a safer digital payments ecosystem.
The action is in line with international best practices in financial security in which inactive accounts and outdated user passwords are automatically cleaned up to prevent fraud. Users might feel short-term inconvenience but long-term fraud avoidance and security benefits outshine short-term inconvenience.
Since the new UPI norms are to be implemented from April 1, consumers must act early and update their banking information so they will not be impacted by disservices. Verification of a verified and active mobile number linked to their UPI account is essential for hassle-free digital payments. The banks and Payment System Providers will keep on monitoring non-active numbers with automated provisions in place.
