What Is UPI Explained — How India's Unified Payments Interface Actually Works

UPI processed ₹24.77 lakh crore across 18.4 billion transactions in March 2025 alone — making it the single largest real-time payment network in the world by transaction count, processing roughly 600 million transactions per day on average. The system was built by NPCI on RBI's mandate in 2016 with a deliberately minimal user-facing surface (enter a VPA, enter an amount, enter a PIN, done) layered on top of a relatively complex inter-bank settlement engine that connects 600+ member banks. The simplicity is what made it adopted by everyone from street vendors to multinational retailers; the underlying architecture is what makes it reliable enough to handle peak loads of 8,000+ transactions per second without falling over.

This post covers what UPI actually is, how the underlying architecture works, the difference between UPI and other India payment rails (IMPS, NEFT, RTGS), current transaction limits and fees, UPI Lite and autopay extensions, and the practical security considerations every UPI user should understand.

What UPI actually is

UPI (Unified Payments Interface) is a real-time inter-bank payment system that allows instant money transfers between any two Indian bank accounts using a single identifier — typically a Virtual Payment Address (VPA), mobile number linked to a bank account, or QR code. It was launched by the National Payments Corporation of India (NPCI) on April 11, 2016 under the regulatory mandate of the Reserve Bank of India, with 21 member banks at launch.

Three properties define UPI:

Single-identifier addressing. Instead of entering the recipient's 13-16 digit account number plus 11-character IFSC code (required for NEFT, IMPS, RTGS), UPI lets you send money to a VPA like name@okhdfcbank, 9876543210@ybl, or username@paytm. The VPA maps to the underlying account behind the scenes; the sender never sees or needs the account number.

Real-time, 24/7/365 settlement. UPI transactions clear in under 5 seconds in 99%+ of cases. The system runs continuously — Sundays, public holidays, midnight, all of it — unlike older bank-to-bank rails that paused on bank holidays or after banking hours.

Single app, multiple banks. A single UPI app (Google Pay, PhonePe, Paytm, BHIM, Cred, Amazon Pay, Mobikwik, etc.) can connect to and operate any number of your bank accounts simultaneously. You don't need a separate banking app per bank — the UPI app sits on top of every bank you've linked.

UPI is not a wallet (you don't pre-fund it with money; transactions debit your linked bank account directly), not a payment processor (NPCI runs the rails, not Visa/Mastercard), and not a single-bank service (any UPI app works with any UPI-enabled bank).

How the underlying architecture works

UPI is built on top of NPCI's IMPS rails — the same Immediate Payment Service that handles non-UPI instant transfers in India. The architecture in simplified terms:

1. PSP layer (Payment Service Provider). This is the consumer-facing app — Google Pay, PhonePe, Paytm, BHIM, etc. The PSP doesn't hold money; it just initiates the transaction request on behalf of the user.

2. Bank API layer. Each member bank exposes a UPI API to which PSPs send transaction requests. The bank authenticates the request, debits the sender's account, and forwards the credit instruction to the recipient bank.

3. NPCI switch. NPCI sits in the middle, routing transaction messages between sender and receiver banks, handling settlement netting, and confirming success/failure back to the PSP. This is the same NPCI switch that runs IMPS.

4. Recipient bank credit. The recipient bank receives the credit instruction, posts it to the recipient's account, and sends an acknowledgement back through NPCI to the sender PSP.

The entire round-trip happens in under 5 seconds for 99%+ of transactions. NPCI publishes monthly volume statistics — the system handled 18.4 billion transactions in March 2025, peaking at roughly 8,000 transactions per second during high-load windows like festival days. For context, Visa's global network averages roughly 1,500-2,000 transactions per second.

The key architectural insight: UPI is not a separate payment network. It's an addressing layer (VPA → account number lookup) + an authentication layer (UPI PIN) + a thin app layer built on top of NPCI's existing inter-bank settlement rails. That's why it scaled so quickly — the underlying plumbing already existed; UPI just made it usable.

How UPI differs from IMPS, NEFT, and RTGS

India has four real-time / near-real-time bank-to-bank payment systems. Each has a specific use case and limit. The full comparison is in IMPS vs NEFT vs RTGS; the short version of where UPI fits:

Feature	UPI	IMPS	NEFT	RTGS
Identifier needed	VPA or mobile number	Account number + IFSC	Account number + IFSC	Account number + IFSC
Settlement speed	Under 5 seconds	Under 30 seconds	30-minute batches	Real-time
Operating hours	24/7/365	24/7/365	24/7 (since Dec 2019)	24/7 (since Dec 2020)
Per-transaction limit	₹1 lakh (₹2-5 lakh for select categories)	₹5 lakh	No limit	₹2 lakh minimum, no upper limit
Fee for personal use	Free	Free or ₹2.50-15	Free or ₹2.50-25	₹25-50
Initiated from	UPI app	Bank app	Bank app or branch	Bank app or branch

The practical division: UPI for everyday transactions up to ₹1-2 lakh, IMPS for one-off transfers when you have the account number + IFSC handy, NEFT for non-urgent transfers without time pressure, RTGS for high-value transfers above ₹2 lakh where instant settlement matters.

Transaction limits and fees in detail

UPI's standard per-transaction limit is ₹1 lakh for most categories, raised to ₹2 lakh or ₹5 lakh for specific high-value use cases where NPCI and RBI have approved higher caps.

Category-specific UPI transaction limits (Q1 2026):

Use case	Per-transaction limit	Daily limit
P2P (person-to-person)	₹1 lakh	Bank-set (typically ₹1 lakh)
P2M (person-to-merchant)	₹1 lakh	Bank-set
Insurance premium	₹2 lakh	₹2 lakh
IPO subscription	₹5 lakh	₹5 lakh
Capital markets (mutual funds, stocks)	₹5 lakh	₹5 lakh
Education fees	₹5 lakh	₹5 lakh (raised Q4 2023)
Hospital payments	₹5 lakh	₹5 lakh (raised Q4 2023)
Tax payments	₹5 lakh	₹5 lakh

Individual banks may set per-day or per-transaction limits lower than NPCI's category caps. New UPI registrations on most banks are capped at ₹5,000 per transaction for the first 24 hours as an anti-fraud cooldown.

Fees: UPI is completely free for personal P2P and most P2M transactions. Merchants accepting UPI on RuPay credit cards pay a small interchange fee on transactions above ₹2,000 — but P2P transactions remain free indefinitely under NPCI/RBI policy. The Government of India has explicitly chosen to keep UPI free to drive digital payment adoption; the cost of running the system is borne by member banks via a small NPCI levy rather than by end users.

UPI Lite and autopay — the recent extensions

NPCI has added two notable features in the last few years to address specific user-experience gaps in core UPI:

UPI Lite. A wallet-style extension within UPI apps that allows offline-style small-value transactions up to ₹500 per transaction (₹4,000 maximum balance in the Lite wallet) without entering a UPI PIN. The user loads money from their main bank account into the UPI Lite wallet once; subsequent payments under ₹500 happen with a single tap. This was introduced in September 2022 to reduce server load from low-value transactions that didn't strictly need full bank-to-bank settlement. As of Q1 2026, the per-transaction limit was raised to ₹1,000.

UPI Autopay. A recurring-payment mandate framework that lets users authorize automatic debits for subscriptions, EMIs, SIPs, insurance premiums, and utility bills. The user approves the mandate once with their UPI PIN; subsequent debits happen automatically on the scheduled date up to the approved per-debit limit. Mandate amounts above ₹15,000 require a one-time additional authentication on each debit, per RBI rules. This replaces the older e-NACH (Electronic National Automated Clearing House) flow with a faster UPI-native experience.

Both features have been adopted broadly — UPI Lite handled roughly 9% of total UPI transactions by count in Q1 2026, and UPI Autopay mandates passed 100 million active subscriptions in early 2024.

Security — what the actual fraud risks are

The UPI infrastructure itself is secure. PIN verification happens on the user's device and is checked by the bank, not by the UPI app. Transaction messages are encrypted end-to-end. The NPCI switch validates each transaction before settlement. There has been no documented breach of the core UPI rails since launch.

The fraud risks are almost entirely social-engineering attacks that trick the user into authorizing a transaction they didn't intend, or revealing information that lets the attacker initiate one:

Fake customer-support calls. Fraudsters posing as bank or UPI-app representatives ask the user to install a screen-sharing app (AnyDesk, TeamViewer) to "resolve a transaction issue", then watch the user enter their UPI PIN. The fix: no legitimate bank or UPI app representative will ever ask you to install screen-sharing software or share your PIN.

Fake "collect request" QR codes. UPI supports a "collect request" feature where someone can request money from you, and you approve by entering your PIN. Fraudsters create QR codes labelled as "receive ₹500" but actually generate a collect-request for ₹50,000. The fix: read the screen carefully — UPI apps always show whether you're sending or receiving, and the recipient name, before PIN entry.

Fake refund processing. A fraudster claims you're owed a refund and sends you a collect-request to "process" it. Approving the request debits your account, not credits it. The fix: refunds are pushed to you automatically; you never need to enter your PIN to receive money.

SIM-swap fraud. An attacker gains control of your registered mobile number and re-registers UPI under their device. The fix: enable two-factor authentication on your bank and UPI apps, and report a lost or unexpectedly inactive SIM to your carrier immediately.

The practical security rule: every UPI PIN entry approves a debit from your account. Read what's on the screen before entering the PIN. UPI itself is safe; the human is the attack surface.

What to actually do with this

Three practical takeaways for any UPI user:

Link multiple bank accounts. A single UPI app (Google Pay, PhonePe, Paytm, BHIM) can connect to all your bank accounts. Linking your primary savings account + a second salary account + a parent's joint account means you can switch source accounts per transaction without juggling multiple apps. The switch is a single tap inside the app.

Set up UPI Autopay for predictable bills. SIPs, OTT subscriptions, insurance premiums, gym memberships, and utility bills are all candidates for UPI Autopay mandates. The mandate is revocable any time from inside the UPI app — no calling customer service. This eliminates late-payment fees and the cognitive load of remembering due dates.

Treat UPI PIN entry as a debit approval. Before entering your UPI PIN for any transaction, confirm three things on screen: the recipient name, the amount, and whether you initiated the transaction (versus responding to a "collect request" you weren't expecting). Most UPI fraud disappears the moment users adopt this single check.

Sources

• National Payments Corporation of India (NPCI), UPI Product Overview — npci.org.in/what-we-do/upi/product-overview
• National Payments Corporation of India, UPI Statistics — Monthly Transaction Data — npci.org.in/statistics
• Reserve Bank of India, Master Direction on Digital Payment Security Controls — rbi.org.in
• Reserve Bank of India, Payment and Settlement Systems Act, 2007 — rbi.org.in/Scripts/BS_ViewMasDirections.aspx
• National Payments Corporation of India, UPI Lite Operating Procedures — npci.org.in/what-we-do/upi-lite
• National Payments Corporation of India, UPI Autopay Framework — npci.org.in/what-we-do/upi-autopay