How TF UPI works?

How TF UPI works ?

You used UPI 8 times today.

What happens in those 2.3 seconds between hitting "Pay" and seeing "Success" is some of the most brilliant engineering India has shipped.

Almost nobody has had it explained to us in simple terms.

Here is the full picture.
-
The Scale :
- 23.2 billion UPI transactions in May 2026 (NPCI)
- Rs 29.9 trillion processed in one month
- More volume than US, China and Europe combined
- 49% of the planet's real-time payments

Built in 10 years by Indians, in India.
-
UPI is NOT an app. UPI is a public set of rails, and PhonePe, GPay, Paytm are just different cars driving on the same road.

Four players run on those rails:
- You, with a UPI ID like yourname@hdfc
- Your APP, called the PSP (PhonePe, GPay, Paytm)
- NPCI, the central switch every UPI transaction passes through
- Your BANK, where the money actually lives

The first quiet genius: yourname@hdfc is NOT your account number. It is a Virtual Payment Address that NPCI maps to your real account in real time. That is why you can pay "raj@axis" without ever seeing his account number or IFSC.
-
When you tap "Pay":
1. Your app sends the payment intent to NPCI: receiver's VPA and the amount.

2. You enter your UPI PIN. The second you type it, NPCI's Common Library (which every UPI app must use) encrypts it right on your device, so PhonePe, GPay and Paytm all run the same NPCI cryptography on it. Your app's servers never see your PIN.

3. From that moment, only YOUR bank holds the key that can decrypt your PIN. NPCI just relays the encrypted blob.
- Your app cannot read it.
- The receiver's bank cannot read it.

4. Your bank verifies the PIN, freezes the amount, and tells NPCI "good to go."

5. NPCI looks up the receiver's VPA, finds his bank, and tells it to credit the account.

6. Both banks confirm. NPCI tells your app. You see "Success."

All of this runs on IMPS, the 24x7 inter-bank rails India built in 2010. UPI is the iPhone. IMPS is the cell tower under it.
-
What makes the whole system genuinely secure:
- Your PIN never leaves your phone in readable form. Ever.

- Your UPI ID only works on the device you registered it on. NPCI binds your VPA to your phone's hardware ID and SIM.

- NPCI never touches your money. It only carries the messages between two banks.
-
The fraud you hear about (collect-request, screen-share, fake-QR) does not happen because UPI is broken. It happens because the user is tricked into approving a real, valid transaction. The system does exactly what it is told. It was just told the wrong thing.
-
UPI is, by quiet consensus, the best real-time payment system in the world. 738 million transactions happen this way every day, completely free, with zero fees on you.

✍🏻 Mantra Joshi

Spotted a wrong number or something out of date? Tell me and I'll fix it.