How should UPI platforms balance privacy, fraud detection and law enforcement access? EXPLAINED

National Payments Corporation of India (NPCI) is working with banks and UPI apps to mask users' mobile numbers on the platforms to strengthen privacy as part of a broader effort to make digital payments more secure as UPI transactions continue to grow rapidly in India. Payment apps have reportedly been instructed to make these changes by September 4, 2026. To make this platform stronger and more secure, biometric authentication is likely to play a major role as UPI transactions have crossed 600 million by June 2026, according to the NPCI.

NPCI stated that the technology-based on-device biometric authentication allows users to authorise payments using a smartphone's fingerprint or facial recognition. This feature enables both person-to-person (P2P) and person-to-merchant (P2M) transactions, making the RuPay Credit Card on UPI and allowing users to make PIN-free credit payments.

The proposal came in light of rising text message-based scams in India, which have surged 146 per cent. It has highlighted a sharp shift in the digital fraud landscape of the country towards scam-led attacks, according to the latest Digital Banking Fraud Trends in India 2026 report by fraud detection firm BioCatch.

The report indicated that the rapid expansion of the Unified Payments Interface (UPI), e-commerce, online investment platforms and mobile banking has made the fraud ecosystem of India increasingly digital, high-volume and driven by scams. The report found that although attempted fraud sessions among BioCatch's Indian customers dropped 12 per cent, the total value of attempted fraudulent payments rose 35 per cent, suggesting fraudsters are increasingly focusing on higher-value transactions.

How do UPI platforms balance user privacy with fraud detection?

The NPCI has asked the platforms to display only the last four digits and to default to username-based IDs; experts have outlined a broader framework to ensure privacy gains don't come at the cost of security or accountability. To balance user privacy, traceability sits at the core of this approach, as in this case, mobile numbers would be hidden on public-facing UPI interfaces, and banks, NPCI, and authorised Payment Service Providers (PSPs) would retain secure backend access for essential functions like KYC verification, dispute resolution, and fraud investigations.

This mirrors NPCI's own stated rationale; the directive follows a circular responding to widespread social media complaints, particularly from women, about safety and identity-theft risks tied to visible phone numbers during transactions. Lawful access would remain strictly regulated, with personal details shared with law enforcement only through formal legal channels such as court orders or statutory requests, preventing misuse while preserving investigative capability.

To offset reduced visibility of phone numbers, experts recommend AI-driven fraud detection powered by behavioural analytics, device fingerprinting, transaction pattern analysis, and risk scoring. This aligns with industry trends, including a recent BioCatch report which found SMS scams in India surged 146 per cent and mobile fraud sessions rose 67 per cent between H2 2025 and H1 2026, with fraud increasingly shifting toward high-value transactions even as overall attempted fraud sessions declined 12 per cent, suggesting financial institutions are already strengthening detection capabilities.

Data minimisation and audit trails would ensure only essential information, such as a verified name or a masked number, is displayed, while encrypted logs are maintained in the backend to support regulatory compliance and investigations when needed.

Ultimately, the goal is a balanced approach, maximising user privacy without compromising payment security, financial system integrity, or authorities' ability to probe cybercrime, a principle that has become increasingly urgent given India's massive UPI footprint, which crossed 55 crore users as of June 2026, according to government data.