How Does UPI Work?
You scan a QR code at a chai stall, enter your PIN, and two seconds later the shopkeeper's phone says "₹20 received". Behind that moment, at least four separate organisations talked to each other: your app, your bank, a national switch and the shopkeeper's bank.
UPI (Unified Payments Interface) is the system that makes them work as one. It now handles hundreds of millions of payments every day. Here's what actually happens when you tap Pay.
🎯 Quick Answer (30-Second Read)
- UPI is a set of rails, not an app. PhonePe, Google Pay and Paytm are front-ends on the same shared system.
- NPCI runs the central switch that routes every payment between banks. It doesn't hold your money.
- You pay to an address (like
name@bank) instead of an account number. The system looks up the real account. - Your UPI PIN authorises the debit with your own bank.
- Money moves bank to bank instantly, 24×7, and both sides get confirmations within seconds.
UPI at a Glance
The Players in Every UPI Payment
| Player | Example | Job |
|---|---|---|
| UPI app | PhonePe, Google Pay, Paytm, BHIM | The interface you use |
| PSP bank (payment service provider) | The bank behind your UPI app | Connects the app to UPI |
| Your bank (remitter) | Where your money sits | Checks your PIN, debits you |
| NPCI UPI switch | Run by NPCI | Routes the payment between banks |
| Receiver's bank (beneficiary) | The shopkeeper's bank | Credits the shopkeeper |
What Happens When You Tap Pay
Step by step:
- You enter the amount and UPI PIN. The PIN is encrypted on your phone and never shared with the app company in readable form.
- Your app's PSP bank sends the request to NPCI.
- NPCI resolves the address.
shop@bankis a VPA (Virtual Payment Address). NPCI asks the receiver's PSP which real bank account it points to. - Your bank verifies the PIN and debits you. Only your bank can check your PIN.
- The receiver's bank credits the shopkeeper.
- Confirmations flow back to both phones, usually within seconds.
Why Pay to an Address Instead of an Account Number?
Before UPI, sending money meant typing an account number and IFSC code. One wrong digit, and the money went to the wrong place.
A VPA like anurag@okbank (or a QR code containing one) is easy to share and doesn't expose your account number. The system maps it to the real account behind the scenes.
Collect Requests vs Pay
- Pay (push): you send money. This is what happens when you scan a QR code.
- Collect (pull): someone requests money and you approve it with your PIN. Scammers misuse this ("enter your PIN to receive money"), so remember: you never need your UPI PIN to receive money.
How UPI Got Here
Why Is UPI Free?
From 2020, UPI payments to merchants carried zero MDR (merchant discount rate), so shops paid nothing to accept them. That's a big reason QR codes spread to every street stall. From 15 October 2026, a 0.4% MDR applies to some merchant payments above ₹2,000, paid by the merchant, not the customer. Payments up to ₹2,000 stay free.
Under the Hood: UPI's Architecture
UPI is a hub-and-spoke system. Apps never talk to each other's banks directly. Every payment goes through one central switch run by NPCI, which every bank and app connects to with the same standard APIs.
(PhonePe, GPay, Paytm)"] CL["NPCI secure library
(PIN entry)"] end CL -.->|"encrypted PIN"| A A --> PSP1["Payer PSP bank"] PSP1 <--> SW{{"NPCI UPI switch
routing + address lookup"}} SW <--> REM[("Your bank
verifies PIN, debits")] SW <--> PSP2["Payee PSP bank
resolves shop@bank"] SW <--> BEN[("Receiver's bank
credits")] SW -. "net positions,
10 cycles a day" .-> RBI[["RBI settlement accounts"]]
Four design decisions explain why it works.
1. Two-factor security without cards or OTPs
- Something you have: when you register, the app verifies your phone number by sending an SMS from your SIM. The app is bound to that device and SIM, which is why changing phones means re-registering.
- Something you know: your UPI PIN is typed into a secure component provided by NPCI inside the app and encrypted before it leaves the phone. Only your bank can verify it. PhonePe or Google Pay never see it.
2. Instant for you, settled later between banks
Your account is debited and the receiver's account credited within seconds. But the actual money between banks doesn't move payment by payment. NPCI adds up what each bank owes and is owed, then settles the net amounts through the banks' accounts at the RBI, in 10 settlement cycles a day (since August 2024).
3. Designed for failures: "money debited but not received"
With five parties in every payment, something occasionally times out. UPI handles this with:
- A unique transaction ID for every payment, so retries can't debit you twice
- Status-check APIs that apps and banks use to find out what happened to a pending payment
- Automatic reversals when the debit succeeded but the credit failed
The RBI sets deadlines: for a failed person-to-person payment, the money must be reversed by the next day (T+1). If the bank misses that, it owes you ₹100 for each day of delay.
4. UPI Lite: skipping the bank for small payments
Tiny payments like ₹10 for tea still hit your bank's servers, which is where most failures happen at peak times. UPI Lite moves a small balance into an on-device wallet. Payments up to ₹1,000 are paid from it without a PIN and without a real-time bank call, with a wallet limit of ₹5,000 (raised by the RBI in December 2024).
How It Handles Huge Scale
- The switch only routes and confirms. Debits and credits are spread across hundreds of banks.
- Small messages: each payment is a few short API calls, not heavy data.
- One standard protocol: a new app joins via a PSP bank and instantly reaches every bank.
- Weak links are the banks: when a payment fails at peak time, it's usually one bank's server, not UPI itself. That's why NPCI publishes bank-wise failure rates, and part of why UPI Lite exists.
Frequently Asked Questions
Who runs UPI?
UPI is run by NPCI (National Payments Corporation of India), a not-for-profit organisation set up by the RBI and the Indian Banks' Association in 2008. NPCI operates the central switch and the rules, while banks hold the money and apps provide the user interface.
Does PhonePe or Google Pay hold my money?
No. For normal UPI payments, money moves directly between bank accounts. The app is an interface connected to UPI through a partner bank. Your balance stays in your bank account, and your UPI PIN is verified by your own bank.
Why does a UPI payment sometimes show "pending"?
A payment can be held up if one of the banks involved responds slowly or times out. The system then checks the status and either completes the payment or reverses the debit. In most cases it resolves on its own, and failed debits are refunded to your account.
Do I need my UPI PIN to receive money?
No, never. A UPI PIN is only needed to send money or approve a collect request. Anyone asking you to enter your PIN "to receive" money is attempting a scam.
Conclusion
UPI works because it separates the jobs: apps handle the experience, banks hold the money, and NPCI's switch connects everyone with one standard. You pay to a simple address, your bank verifies your PIN, and money moves bank to bank in seconds, hundreds of millions of times a day.
Sources
- NPCI: UPI settlement process
- Business Standard: RBI enhances UPI Lite limits (Dec 2024)
- RBI: harmonised turnaround time and compensation for failed transactions
- NPCI: UPI product overview
- Business Standard: UPI transactions, September 2026
- Ministry of Finance: FAQ on MDR on select UPI P2M transactions (Sep 2026)
- NPCI press release: UPI crosses 1 billion transactions (Oct 2019)
Last verified: 14 October 2026.
Related reads: How WhatsApp Works at Scale · Load Balancer Explained · Why India Needs Bilingual Search Models · How Swiggy Built a Logistics Network Without Addresses
I write about how India's tech gets built. Follow on LinkedIn or X, or invite me to speak.