On this page
You scan a QR code at the canteen, type 60, enter a PIN, and a tick appears. Behind that tick, several computer systems have exchanged messages. Here is what each one does, in the order NPCI's own rules describe.
What is UPI, in one sentence?
The Unified Payments Interface (UPI) is a shared set of rules for how payment apps and banks message each other, with the National Payments Corporation of India (NPCI) running the central switch in between. NPCI's UPI procedural guidelines call UPI “architecture and a set of standard Application Programming Interface (API) specifications”, and describe NPCI as the “owner, network operator, service provider, and coordinator of the UPI Network”.
According to a Press Information Bureau factsheet published in August 2026, UPI started as a pilot in April 2016 with 21 member banks. The same factsheet says that in July 2026 the system had 741 live banks and processed 2,365.8 crore transactions worth ₹29.87 lakh crore.
Who is involved in a UPI payment?
The guidelines name up to four parties, plus NPCI in the middle:
Payer PSP: the payment service provider whose app you pay from.
Remitter bank: the bank that holds your account and sends the money.
Payee PSP: the app provider of the person you are paying.
Beneficiary bank: the bank that holds their account and receives the money.
When your app and bank are one company, the chain is shorter. If all four differ, it is the guidelines' four-party model.
What is a UPI ID (VPA), and who looks it up?
A UPI ID, or virtual payment address (VPA), has the form username@psp, where NPCI gives each provider its psp handle, according to the procedural guidelines. The ID is a label, not your account number. The provider that issued it keeps the table that maps it to a real account, so you can pay someone without either of you sharing bank details.
How does a UPI payment work, step by step?
Take a made-up example. Riya, with the ID riya@pspA, pays ₹60 to canteen@pspB. Her bank is Bank A; the canteen's is Bank B. Following the four-party push flow in NPCI's guidelines:
Riya enters canteen@pspB and ₹60 in her app and types her UPI PIN.
Her app sends a pay request, with her encrypted PIN, to NPCI's UPI switch.
NPCI reads the handle “pspB” and asks that provider to resolve canteen@pspB.
The canteen's provider replies with the account details behind the ID.
NPCI sends a debit request to Bank A.
Bank A checks the PIN, takes ₹60 from Riya's account and confirms.
NPCI sends a credit request to Bank B.
Bank B adds ₹60 to the canteen's account and confirms.
NPCI tells Riya's app it worked, and the tick appears.
Riya's bank debits her before the canteen's bank credits it. The banks settle totals with each other later, through their accounts with the Reserve Bank of India, which NPCI arranges.
How is your PIN kept secret on the way?
The guidelines require two factors for every financial transaction: your registered phone, which your app's provider checks through a device fingerprint, and a four- or six-digit UPI PIN checked by your bank (or Aadhaar biometrics, checked by UIDAI). The app's NPCI library encrypts the PIN with NPCI's public key. NPCI decrypts it with its private key, encrypts it again with your bank's public key and passes it on. Your bank decrypts it with its own private key, inside a hardware security module, and checks it. The PIB factsheet adds that UPI Lite allows small payments without a PIN, and since 2025 some payments can use your phone's fingerprint or face recognition.
This is public-key cryptography: anyone can lock a message with a public key, but only the matching private key opens it. To see why the maths works, the Fermi Concept Library has a lesson on every concept in mathematics and computing. For catching typing mistakes, read how Aadhaar's Verhoeff check digit works.
What should you check before you tap pay?
Use the flow as a checklist:
Read the payee's name before the PIN. A UPI ID is only a label, and a look-alike ID can belong to someone else.
A PIN screen means money is leaving your account. In the payment flows in NPCI's guidelines, only the payer enters a PIN. If someone says you must enter your PIN to receive money, they are asking you to pay them.
A pending payment means your app has not yet had the final confirmation. The guidelines require apps to offer “Check Transaction Status” and an in-app complaint option, so use those before paying again.
Never share your PIN. Only your bank should ever check it.
For spending limits and scam rules for teenagers, read should your teenager use UPI. For habits that keep a PIN private, see how to teach kids strong passwords.
