13 ms·

UPI: India's Unified Payments Interface

345 points by zero_kool 6y ago

jgalt212 6y ago
There are just so many things that make me fearful of either losing my phone or having it irreparably damaged. The account recovery process can be a. too hard or impossible (Hi Gitlab!) or b. too easy (too simple security questions).
- nine_k 6y ago
  2FA with some rescue codes printed and kept in your wallet / safe box seems like a reasonably bulletproof setup (hi GitHub!), but not every important site offers this.
  - scoot 6y ago
    Printing them and carrying them in a wallet that could be lost or stolen seems like asking for trouble.
    - krtkush 6y ago
      I keep all my secure codes in my password manager.
    - nine_k 6y ago
      Unless you're a victim of a targeted attack, and the perpetrators know your accounts and go to immediately hijack them, it's a non-issue. You just generate and print new rescue codes, and the old codes become invalid.
  - jgalt212 6y ago
    Yes, that's decent. I also like services that allow you register multiple 2FA devices for an account. e.g. my back up phone not only serves as my back up phone, but also my back up 2FA device. I believe rackspace allows this.
- tialaramex 6y ago
  I can't figure out which account you're worried about here. Your bank presumably knows a bit more about you than... nothing like a free Gitlab user and the account is valuable to both of you. So they can "just" do old fashioned manual account recovery as they would have in 1820 or 1920. If I lose my phone and all backup authenticators, maybe in a house fire or something, I can live with the fact that maybe I need to go in person to a big stone building and talk to a human face-to-face about account recovery. My home just burned down, I think I can make a little time for essentials like that.
- ratherlongname 6y ago
  No such issue with UPI. 2FA makes sure no one can do payments from your lost phone; and the signup process for UPI (on a new phone) literally only involves creating a PIN as the bank account associated with your current phone number is added automatically through SMS verification.
lykr0n 6y ago
I'd love for the US to adopt a standard that is bank agnostic, like ACH, but allows for near real-time payments from P2P but also person to business payments. It's a big problem when Visa, Mastercard, and PayPal control a large part of money transactions.
- ktta 6y ago
  There is one. It is called RTP - Real time payments It is currently undergoing adoption among several big banks, although adoption for individual non-corporate accounts is slow
  - toomuchtodo 6y ago
    How does it compare to Zelle (Early Warning Systems) from an integration and cost perspective for financial partners? Personally, I’d rather the Fed run real time payments instead of some private consortium made up of the largest US banks (some governance/overnight vs less so as a private corporation), but the Fed’s been dragging their feet for years while Zelle has rolled out quickly. Humorously, Facebook’s Libra is what set a fire under the Fed [1] [2]. [1] https://www.bankingdive.com/news/fed-gives-new-details-on-its-real-time-payments-system/583153/ https://www.bankingdive.com/news/fed-gives-new-details-on-it... [2] https://www.federalreserve.gov/newsevents/pressreleases/files/other20200806a1.pdf https://www.federalreserve.gov/newsevents/pressreleases/file... (warning: 50 page pdf)
    - hutzlibu 6y ago
      "Personally, I’d rather the Fed run real time payments instead of some private consortium made up of the largest US banks " I allways thought, that the fed is exactly this? A private consortium out of the biggest US banks? (But I am not a US citizen, but this is what I understood and thought strange, compared to the EU for example)
      - toomuchtodo 6y ago
        It’s a public private hybrid entity that is accountable to the US Congress (who also defines their mandate). https://www.federalreserve.gov/faqs/about_12798.htm https://www.federalreserve.gov/faqs/about_12798.htm
deleted 6y ago
[deleted]
atemerev 6y ago
As if what we need is even more surveillance capitalism...
- PaulDavisThe1st 6y ago
  Every electronic transaction you're involved with is already surveiled, so it's hard to see how that would change. But how about NOT having to pay banks for instantaneous funds transfers to any 3rd party? And how about actually have instantaneous funds transfer to any 3rd party (something which does not exist in the US banking system) Same surveillance, lower costs, faster payments.
  - atemerev 6y ago
    Bitcoin already works for cheap international transfers. And no, my bank won’t give any details about my account and its transactions (unless I do something really horrible), even to the national tax authorities (I live in Switzerland, where bank secrecy is still a thing, at least for the residents/citizens).
    - vinay427 6y ago
      This is generally true in Switzerland as you stated (with those exceptions for more serious issues) for residents, as Swiss citizenship is irrelevant. Anyone resident in any of a host of countries with which Switzerland has signed agreements can have their bank details shared with the country of residence. I suspect a fair amount of other countries have this discrepancy as well. Based on a brief online search it seems like the data on US checking/savings accounts of US residents are not shared with the IRS, for instance, unless a summons (which can be contested) is approved. I'm not sure what the difference is in practice.
Kednicma 6y ago
Great idea; let's have USPS administer it, like they used to do for money orders and wire transactions. No sense in replacing Mastercard with Google.
- kadoban 6y ago
  The USPS doesn't seem like it's going to exist in a few more months.
  - not2b 6y ago
    Killing it will hurt rural areas, Trump's base, far more than urban areas, where there are other possibilities to get things delivered. If it's destroyed, the guilty party (Trump) will be destroyed, and it will be put back together next year.
- dodobirdlord 6y ago
  I think this is an excellent suggestion, assuming the post office survives an ongoing calculated attempt to cripple and privatize it. Routing digital payment requests to bank addresses is a natural extension of the responsibility of routing all physical mail to any physical address.
  - patmorgan23 6y ago
    I think the Fed is a better place to administer this. It already does checks and ACH payments.
  - deleted 6y ago
    [deleted]
- smart_jackal 6y ago
  Except that UPI is a payment standard, Google neither has monopoly over it nor the only one payment company who supports UPI in India, there are many others like Paytm, Phonepe, Mobikwik, etc.
- PaulDavisThe1st 6y ago
galaxyLogic 6y ago
It takes like 3 days to pay my Chase credit-card from my Citibank account. Lots of waste happening in the financial system.
- yokaze 6y ago
  AFAIK, that's not waste, it's intentional. That's three days of that money out of your books, and on the banks side.
  - ckdarby 6y ago
    While this is true a lot of banks would like to do it instantly as it would be an advantage over others and drive more people to sign up for the feature. The real problem is most banks backend systems are still old mainframes where this isn't possible. Source: I'm a prior developer at multi-billion dollar payment processor working with many acquirers.
    - orf 6y ago
      > The real problem is most banks backend systems are still old mainframes where this isn't possible. The rest of the world manages it. Do they not use mainframes?
      - tialaramex 6y ago
        In the UK at least the answer was government fiat. Faster Payments is the unimaginative name for the rule that allows most UK bank account holders to move money the same day (typically in reality instantly) at zero cost to them. The date for Faster Payments becoming possible was set, and banks are just obliged to provide it. Some were earlier, most were not. The banks did not actually implement the underlying backend transfers in time, but customers don't care. Rick Smith, father to an 18 year old daughter who seemingly always needs another few hundred quid for something wants to send Beth £750 right now, and Beth wants to be able to spend that money when she receives it from her father. Neither of them cares that Rick's and Beth's banks are running different versions of some 1970s COBOL application or are struggling to ensure a backend funds transfer matching the Rick-> Beth transaction happens in a timely fashion. So the banks just faked the UX. This technically means if Rick's bank fails after Rick sent the money, but before the backend catches up in a day or two, Beth's bank (but not Beth or Rick) could lose the value of the transaction because the underlying money actually didn't go anywhere yet, just the two account balances were updated. But regulators reasoned that banks being more likely to freak out and report if they suspect their competitors are struggling and likely to fail imminently is a good thing so let them take that risk. Maybe they have subsequently fixed their backends, maybe they didn't, as an end user I needn't care so I paid no further attention.
Finster 6y ago
The big concern I have here is that the address resolution seems similar to DNS... Which is very bad, IMHO. Are they taking necessary steps to mitigate ddos and Man in the middle attacks? If they're not, they're seeing themselves up for major disaster.
- godelmachine 6y ago
  >>Just like how domains get resolved to IP addresses, every VPA needs to be linked to a bank account. The UPI handles get resolved to bank accounts and IFSC during the payment (we will see how). I am sure I am missing something. Just curious to know where do you see an attack vector for DDoS or MOTM attack?
- arafsheikh 6y ago
  I don’t know about UPI, but those concerns can be mitigated by not operating on public networks. The SWIFT payment network for example is private[1] and is only accessible via dedicated routers. [1] https://www.exalog.com/en/swiftnet-network-banking-communication https://www.exalog.com/en/swiftnet-network-banking-communica...
  - closeparen 6y ago
    Relying on perimeter security like this means you are as vulnerable as your weakest nodes. SWIFT can be and has been hacked via its less sophisticated participant banks.
- ta2987 6y ago
  > Which is very bad, IMHO. Not humble enough not to shit on something you admit you don't know much about.
- sudeepj 6y ago
  > Are they taking necessary steps to mitigate ddos I am not sure how this would happen in this case. If you want to flood the system you will have initiate a lot of payments which will be costly. Both sender and receiver are authenticated with bank, so there is a traceability. Also, you need a bank license from the central bank to act as a bank and each UPI is linked to an bank account which itself is linked to details. To add, it is now difficult (not impossible) to have anonymous bank account because they are linked to a central ID called Aaddhar number [1] and other KYC procedures. One will have to really execute an elaborate scam like in Ocean's 11 movie to make this work. [1] https://en.wikipedia.org/wiki/Aadhaar https://en.wikipedia.org/wiki/Aadhaar
filleduchaos 6y ago
It amazes me how seemingly behind US banking is tech-wise. My home country for instance has the Nigerian Inter-Bank Settlement System for decades; it's quite similar to the UPI but primarily led by the central bank (plus participation is mandatory for all banks/bank-like institutions). For anyone that's curious, the platform's home page at https://nibss-plc.com.ng/ https://nibss-plc.com.ng/ has a nice little statistics summary of both POS and account-to-account transactions (you might have to scroll past the fold). There's five-minute and whole day numbers for total transactions and error rate broken down into types of errors - it's a nice bit of transparency.
- blisseyGo 6y ago
  I think US (and other western countries like Canada, European countries etc) are VERY different from the Indian market. In US, Canada etc, everyone has an email and banks allow interactive payments already. I have yet to have a single time where I had problems paying someone for something. Interac etransfer works well. Even iMessage, FB messenger etc allow payments. Other services like PayPal, Stripe, Patreon cover the rest of the base. India is a completely different market. There are millions of people there who don't even have a bank account, nor do they have email. The road-side vendors use cash.
  - filleduchaos 6y ago
    The other thing that amazes me is how quickly people will jump to defend the US' hodge-podge of third-party walled garden options. I've been able to send near-instant account-to-account transfers for a decade, for a stamp charge capped at the equivalent of about thirteen cents, via a first-party platform that every bank or bank-like institution is required to be part of. So yeah, "options" like "join Facebook" or "wait a couple business days for your transaction to be complete" or "pay (comparatively) exorbitant fees" will always sound inherently ridiculous to me. To my knowledge the situation in the US is getting better with the rise of Zelle, but that's still a half-assed solution - not all institutions participate, and customers have to opt in to it. Quite a few (older) people I've talked to don't even know it exists. > India is a completely different market. Ironically you are quite close to getting the point here, which is that India (and many other developing nations) are able to build and push the cutting edge of national fintech precisely because they don't have decades if not centuries of cruft and technical debt weighing them down. They can skip the inefficient stages of development that developed nations went through and go straight to creating banking systems for the 21st century.
zimbatm 6y ago
The article looked great until the introduction of the NPCI system. It's essentially a single point of failure, and the best place to observe all the transaction of the whole country. It's controlled by the Government so it will be really tempting to peek into it. > Imagine the pain that everyone has to go through in reaching a consensus when configurations or infrastructures change. It would be chaos. Welcome to the Internet.
- themacguffinman 6y ago
  So is the Federal Reserve, so is the SEC, so is the IRS, so are all the financial reporting laws that require transactions to be reported to the US government for audit and regulation. I fail to see how NPCI is any different. The solutions won't be any different either: the government has laws restricting unregulated access to data and developers will implement access controls to enforce these laws. The financial system in practically every country is already fully controlled by a central authority, and for good reason: finance is critical to national security and financial decisions are inherently political, therefore finance is controlled by political authorities.
  - captn3m0 6y ago
    You are wrong on one very important point: NPCI is a non-government entity. It is a not for profit corporation that acts as a conglomeration of banks. The government gets a day in it by 1. owning public sector banks and 2. By regulating it indirectly as RBI (which is itself quite autonomous). It is more akin to a not for profit VISA than the Fed Reserve.
    - themacguffinman 6y ago
      > NPCI is a non-government entity Fair correction. However, correct me if I'm wrong, it still plays the role of a singular national authority blessed by the central bank. I'm skeptical that its non-government status is an important distinction when it appears to be an exclusively Indian institution co-established by the RBI. I don't think Visa's status is quite the same: Visa has actual competitors and operates under many foreign jurisdictions. I'd say the NPCI is as trustworthy and protected as the government institutions that bless it.
deleted 6y ago
[deleted]
quarantine 6y ago
This looks like a Bancontact/SEPA combination.
not2b 6y ago
I've made five trips to India for business, the most recent was in 2017. The system that was instituted just before my last trip caused me major problems, as suddenly two things happened: foreign credit cards were no good for payments online (I had to get a colleague to buy my Taj Mahal ticket online and pay him back with cash), and it was suddenly much more difficult for some people I was trying to pay to accept payments in cash; restaurants and hotels could still get it done, but for others it was a major problem. I hope they have these issues straightened out by now.
dheerendra73 6y ago
As a UPI user who is using this from literally day 1 and who is hard core advertiser of this, here are few important points: 1. Security: Signup requires phone number validation via SMS and phone number must be registered with bank. It also requires additional details like debit card validation. This makes is hard to spoof. After signup your device finger print is stored with NPCI and this works as 1st factor. An additional PIN is also required during signup. You can send money only from registered device and requires fingerprint and pin validation. 2. Every digital transaction in India triggers SMS, so that provides additional transparency to user. 3. All payments are from bank account to bank account and they happen in real time! Also no transaction fee! 4. Merchants require no special equipments and they advertise their VPA usually via QR code in shops so it’s easy for users to pay. 4. Online payments can be either user triggered or can be requested via pushing payment request to user app. However user needs to approve the request with pin. Point 3 & 4 were the biggest reasons why India adopted it pretty quickly. Also ofcourse due to Jio boom & cheap chinese smartphones!
- 9nGQluzmnq3M 6y ago
  Q: If a phone number has to be registered and validated, why not use that as the unique ID, instead of creating a separate VPA? For comparison, in Singapore, the local UPI-like "PayNow" network uses numbers as IDs, meaning you can easily send money to anybody in the system (these days virtually everybody) without needing to know their bank. You can also transfer to any Singaporean company or organization via their Unique Entity Number, which is an existing company/org ID assigned at formation that includes a checksum. https://abs.org.sg/consumer-banking/pay-now https://abs.org.sg/consumer-banking/pay-now
  - actuator 6y ago
    From my understanding, I think just your phone number/VPA is enough to send money. I am not sure how it works in practice but I assume the VPA concept is there so that your phone number is not exposed if you don't wish to.
    - captn3m0 6y ago
zorro58 6y ago
UPI is a fascinating battle field of tech companies. I had a front seat to some of the negotiations happening to build platforms on UPI. There was a fear in India that foreign tech companies would monopolize that platform. Concurrent with negotiations to build on UPI, there were also leaks and stories by both sides in the press to bolster or communicate positions. For example, there was one story where an official said that a tech CEO made a commitment. The tech CEO did not make that commitment. That company's team had their own set of meeting notes confirming their position. Other companies were livid with the tech company for supposedly taking that position. With the story now published, the tech company could not publicly deny the story or else they would anger the other side. So they quietly rolled with it. It is also a credit to PayTM's CEO. Their CEO saw that succeeding with UPI was a matter of survival. Backed up against a wall, he fought back against his competitors with everything he had and is winning so far. Someone needs to write a book on the behind the scenes happenings.
- akritrime 6y ago
  That's so fascinating. If I wanted to know more about this side of Indian fintech, where should I start?
  - captn3m0 6y ago
    Read everything by Arundhati on The Ken. She covers fintech extremely well.
- signal11 6y ago
  > winning so far Given PayTM’s losses[1,2], I find “winning” an odd choice of words. The reality is that digital payments in India experienced an artificial “bump” following India’s ill-thought demonetisation experiment, which has evaporated since. And what growth there is, is on vendor-neutral UPI (which Facebook, Google, Jio et al can all use) rather than proprietary e-wallets like PayTM. [1] https://timesofindia.indiatimes.com/business/india-business/paytm-cuts-losses-20-as-e-pays-fall/articleshow/75260576.cms https://timesofindia.indiatimes.com/business/india-business/... [2] https://www.livemint.com/companies/news/paytm-sees-its-losses-surging-in-2019-20-1550425042400.html https://www.livemint.com/companies/news/paytm-sees-its-losse...
throwaway432334 6y ago
Engineering wise, it's a miracle that UPI works. All of the banks have very little in the way of consistency checks and proper abstractions. Everything is superglued together and very brittle. There was clearly little direct communication between NPCI, the issuing banks, and the users of the apis in development. I agree with India's protectionist attitudes that's kept Western companies from monopolizing the ecosystem though. It works well enough, much to chagrin of SV tech companies lol.
varbhat 6y ago
UPI is not nice. 1) UPI is unreliable. Based on my experience, it doesn't work many times per day. I once needed to beg my friend to pay for me after realizing that it didn't work when i purchased something in shop but had no money(only upi account) 2) It is closed source. UPI forces every App that uses UPI to use it's closed source code. 3) I find Bank transfer like IMPS/NEFT more reliable than UPI. 4) One advantage of UPI is it's id which led to discovery of account (through qr code) . This is also the reason it got adopted by people.
- iKevinShah 6y ago
  "UPI is unreliable" Not saying it is 100% reliable, but there's a good possibility the aggregator you are using (GPay / PhonePay / etc.) might have issues on the whole or with the account.
  - abtom 6y ago
    In my experience it's usually the bank having an issue on their end. If you try to make a transaction late at night, say 2am, there's a good chance your bank is "down for maintenance". My account is with a public bank, not sure if this is true for private banks. Either way, reliability varies from bank to bank. One reason behind this (communicated to me by a friend who has some insight into the banking system) is that the government has prohibited charging for UPI transactions. So every bank needs to maintain the infrastructure to integrate with UPI but don't make money off it. This leads some to not treat it with priority (a good to have, not a necessity) or treat it like IMPS/NEFT/RTGS (which only work in a fixed time window). Overall the reliability is still quite good and with increasing reliance of the masses on it, it will hopefully get better.
    - vinay_ys 6y ago
      UPI usage/traffic has grown orders of magnitude each year. That kind of growth isn't handled reliably by the best of the startups even today (remember twitter in its early years?). Banks do invest a lot of money/resources into running/managing UPI but that alone isn't enough. There is no substitute for time and experience (talent) that's needed for the culture change within bank IT teams to mature, and their leadership teams – they have to shift their thinking to deal with the pace of growth and frankly the pace of changes as well.
sandGorgon 6y ago
It is a super exciting time to be doing fintech in India. Here are the open APIs. UPI = Venmo + Paypal UPI Autopay = open credit card subscriptions pull PCR = Open FICO+Equifax NBFC-AA = Open Plaid Digilocker = Open docusign+dropbox OCEN = Open Lendingclub Together, they are called IndiaStack (along with our upcoming health and drone apis).
- kumarharsh 6y ago
  Plus Aadhaar, eSign, and eKYC
Abishek_Muthian 6y ago
I tell about UPI to my friends in Western countries, When they tell how easy and seamless Apple Pay has made their payments, they're often surprised that such system exists here. One can download GPay or plethora of other apps to setup UPI to sync with the bank accounts within minutes and conduct transactions. With vernacular support/affordable cellular data, these apps have found its users even among those who have never used a computer in their life to login to their banking portal or used debit card before to conduct any online transactions earlier. Now, what 'I' don't like about it, Extraordinary dependence on 'Mobile Number' for security, RBI(India's central bank) requires personal phone number to be synced with the bank account, so these 'UPI' apps send SMS from the phone at random to 'verify' that it's actually you i.e. if the phone number matches its you. If you are like me, who has the phone in aeroplane mode 24*7 or use cellular on-demand be prepared for transaction failures at best to getting locked out of the UPI apps at worst. Then there is the question of SMS OTP as the backbone of Indian banking infrastructure's 2FA security, we know SIM-Jacking attacks are getting prevalent every passing day, coercing an employee of a Telecom who earns minimum wage is not that difficult and especially since there is zero 'cyber-security' awareness among much of the population; attackers just dupe many of them into giving them the OTP[1]. It's high time banking infrastructure here start supporting hardware tokens or at least TOTP apps and UPI has to hedge its unique id dependence to email id as well. [1]https://economictimes.indiatimes.com/wealth/save/beware-of-these-6-frauds-while-making-payments-via-upi-amid-lockdown/articleshow/75671798.cms https://economictimes.indiatimes.com/wealth/save/beware-of-t...
- achow 6y ago
  > these apps have found its users even among those who have never used a computer in their life The only internet connected device these users have are the cheap smartphones and within the phone perhaps only complex apps that they are familiar with is messaging (apart from entertainment and 'selfie' related ones). So any other authentication mechanism (email or others) would see the usage plummet.
  - Abishek_Muthian 6y ago
    >So any other authentication mechanism (email or others) would see the usage plummet. True, but Security > Friction; especially when it comes to hard earned wealth in a poor country like ours, where even daily wage earners use UPI now, especially because of COVID-19 induced lockdowns(COVID-19 themed UPI frauds for OTP are also increasing at the alarming rate for the same reason). More over email is Federated, not owned by any single entity, I can run my own email infrastructure with minimal expenditure if needed. But for phone number itself I have to depend upon a Monopoly, Duopoly or an Oligarchy at best who if needed can screw me up if they want at anytime.
pedrocx486 6y ago
Brazil is doing a similar bank-agnostic system called PIX. Kinda interesting how in the previous thread where I mentioned it a lot of people were against it because it was "not competitive" while here I'm seeing (mostly) praise for UPI. IMHO, this is how it should be, a bank-agnostic standard set by the central bank that other services use to connect to the central and with each other. Competition is good? Yes, but not when it's a complete mess.
perryizgr8 6y ago
I love UPI and it has proved to be a boon in this time when I am scared of touching cash. It's very fast, easy and quite reliable in my case. In Bangalore, it works literally everywhere. From the smallest shops to big supermarkets. Many small shopkeepers even discourage me from paying in cash. But people need to realize one aspect of UPI that it is exactly as unsafe as cash. Would you send cash to someone over the phone for accepting delivery of a product later? No. So don't do that with UPI. Use UPI when it would be appropriate to use cash, when you're standing face to face with the seller. Just think of it as more convenient cash. Otherwise, it is ripe for exploitation by thieves.
- blueblisters 6y ago
  > Just think of it as more convenient cash. Yup exactly. As someone mentioned above, it's a frictionless payments system, unlike Visa/Mastercard which also offer dispute resolution. Of course, if you trust the vendor, I don't see why you should implicitly pay for the protection mechanism of Visa/Mastercard when UPI is literally free.
  - captn3m0 6y ago
    > when UPI is literally free So far. Lots of banks are fighting to introduce fees. The actual cost is getting subsidised so far, but there are no free lunches. Banks can't keep this up forever.
sseth 6y ago
UPI is growing at an incredible rate. One important reason for the growth is the explosive increase in 4G connectivity in the last 4 years, which has data usage on mobile see a compound average growth of 93% to become the highest in the world at 11.2 GB per user / month. The rates are almost laughably cheap, at around 0.20 USD/GB. COVID has also driven more recent growth because people don't want to handle cash.
gingerlime 6y ago
Slightly OT, but what's the simplest way to offer more payment options online in India? Is there a way to set up UPI as a foreign company? For context: we're a small B2C bootstrapped company offering online anatomy learning. We use Stripe and Paypal (via Fastspring), but it seems like it's far from enough for the local market in India...
- pkphilip 6y ago
  The best option is to tie up with a payment gateway like Razorpay, Instamojo etc. They allow a variety of payment methods including UPI and also what is called "Net Banking" - which is direct transfers from a bank account even without UPI being used. They also support a variety of wallets. Instamojo actually advertises that they support over 100 payment methods. Some of these payment gateways also allows you a "Pay Later" option which allows the user to pay via a micro loan that they take from the gateway. This is apart from the credit card, debit card options. Razorpay: https://razorpay.com/payment-gateway/ https://razorpay.com/payment-gateway/ Instamojo: https://www.instamojo.com/ https://www.instamojo.com/
  - captn3m0 6y ago
    Razorpay only supports merchants registered in India. Disclaimer: I work at Razorpay.
    - pkphilip 6y ago
      True. They will need some sort of an Indian subsidiary or go through an Indian registered company to allow Razorpay or Instamojo payments
      - gingerlime 6y ago
        Thank you. I’m not sure that’s an option for us unfortunately. Unless you know of some stripe atlas equivalent service for setting up a company in India?
lonesword 6y ago
As an Indian citizen living in Germany right now, I sorely miss UPI. My workflow to order food in India - 1) open app and add things to cart 2) Google Pay (linked to UPI) prompts for my fingerprint and that's it. In Germany, I mostly end up using SOFORT which involves remembering my account number, pin, and then using a mobile OTP. There's no "easy" way to transfer money to friends - everyone either uses paypal or Transferwise, which requires an additional step to withdraw funds to your bank account. When shopping at brick and mortar shops, the payment options are either cash or a card. For a country that enjoys such a high standard of living, Germany has surprisingly underwhelming digital banking infrastructure.
vishnugupta 6y ago
RBI recently issued a circular inviting companies to build a retail payments network, in parallel to UPI [1], under New Umbrella Entity (NUE). Two key aspects of NUE are, it could be a for-profit, and it'll be governed by India's FDI rules, meaning foreign investments are allowed and could even be encouraged as FDI rules get relaxed. Both these are in direct contrast to NPCI's charter which is a not-for-profit and entirely owned by Indian entities. In fact NPCI is a quasi government organisation, owned by a combination of RBI and Indian banking association. Google (through its India subsidiary) has already applied for building/operating an NUE, and I won't be surprised if Facebook has done it too. I just hope that 20 years down the line we won't end up with a fragmented quagmire with half a dozen payment networks each of which don't talk to anyone else. UPI solved a huge problem of interoperability and it'll be a shame if its seamlessness is squandered away. [1] https://www.rbi.org.in/scripts/bs_viewcontent.aspx?Id=3832 https://www.rbi.org.in/scripts/bs_viewcontent.aspx?Id=3832
- wtmt 6y ago
  > Both these are in direct contrast to NPCI's charter which is a not-for-profit and entirely owned by Indian entities. By Indian entities, if you do include Citibank and HSBC (local arms), then yes. The promoters are private and public banks. > In fact NPCI is a quasi government organisation, owned by a combination of RBI and Indian banking association. It's promoted by RBI, but not really owned by it. The ownership lies with the consortium of private and public banks.
known 6y ago
Remembering Bank A/c number + IFSC is safe/better
rootkea 6y ago
The best feature of UPI for me is that it provides USSD code (*99#) to interact with the UPI. Since I only use FLOSS apps (via f-droid.org) on my LineageOS I use UPI without installing any UPI app (which all are proprietary e.g. PayTm, Gpay etc.).

345 points by zero_kool 6y ago

There are just so many things that make me fearful of either losing my phone or having it irreparably damaged. The account recovery process can be a. too hard or impossible (Hi Gitlab!) or b. too easy (too simple security questions).

nine_k 6y ago
2FA with some rescue codes printed and kept in your wallet / safe box seems like a reasonably bulletproof setup (hi GitHub!), but not every important site offers this.
- scoot 6y ago
  Printing them and carrying them in a wallet that could be lost or stolen seems like asking for trouble.
  - krtkush 6y ago
    I keep all my secure codes in my password manager.
  - nine_k 6y ago
    Unless you're a victim of a targeted attack, and the perpetrators know your accounts and go to immediately hijack them, it's a non-issue. You just generate and print new rescue codes, and the old codes become invalid.
- jgalt212 6y ago
  Yes, that's decent. I also like services that allow you register multiple 2FA devices for an account. e.g. my back up phone not only serves as my back up phone, but also my back up 2FA device. I believe rackspace allows this.
tialaramex 6y ago
I can't figure out which account you're worried about here. Your bank presumably knows a bit more about you than... nothing like a free Gitlab user and the account is valuable to both of you. So they can "just" do old fashioned manual account recovery as they would have in 1820 or 1920. If I lose my phone and all backup authenticators, maybe in a house fire or something, I can live with the fact that maybe I need to go in person to a big stone building and talk to a human face-to-face about account recovery. My home just burned down, I think I can make a little time for essentials like that.
ratherlongname 6y ago
No such issue with UPI. 2FA makes sure no one can do payments from your lost phone; and the signup process for UPI (on a new phone) literally only involves creating a PIN as the bank account associated with your current phone number is added automatically through SMS verification.

lykr0n 6y ago

I'd love for the US to adopt a standard that is bank agnostic, like ACH, but allows for near real-time payments from P2P but also person to business payments. It's a big problem when Visa, Mastercard, and PayPal control a large part of money transactions.

ktta 6y ago
There is one. It is called RTP - Real time payments It is currently undergoing adoption among several big banks, although adoption for individual non-corporate accounts is slow
- toomuchtodo 6y ago
  How does it compare to Zelle (Early Warning Systems) from an integration and cost perspective for financial partners? Personally, I’d rather the Fed run real time payments instead of some private consortium made up of the largest US banks (some governance/overnight vs less so as a private corporation), but the Fed’s been dragging their feet for years while Zelle has rolled out quickly. Humorously, Facebook’s Libra is what set a fire under the Fed [1] [2]. [1] https://www.bankingdive.com/news/fed-gives-new-details-on-its-real-time-payments-system/583153/ https://www.bankingdive.com/news/fed-gives-new-details-on-it... [2] https://www.federalreserve.gov/newsevents/pressreleases/files/other20200806a1.pdf https://www.federalreserve.gov/newsevents/pressreleases/file... (warning: 50 page pdf)
  - hutzlibu 6y ago
    "Personally, I’d rather the Fed run real time payments instead of some private consortium made up of the largest US banks " I allways thought, that the fed is exactly this? A private consortium out of the biggest US banks? (But I am not a US citizen, but this is what I understood and thought strange, compared to the EU for example)
    - toomuchtodo 6y ago
      It’s a public private hybrid entity that is accountable to the US Congress (who also defines their mandate). https://www.federalreserve.gov/faqs/about_12798.htm https://www.federalreserve.gov/faqs/about_12798.htm

deleted 6y ago

[deleted]

atemerev 6y ago

As if what we need is even more surveillance capitalism...

PaulDavisThe1st 6y ago
Every electronic transaction you're involved with is already surveiled, so it's hard to see how that would change. But how about NOT having to pay banks for instantaneous funds transfers to any 3rd party? And how about actually have instantaneous funds transfer to any 3rd party (something which does not exist in the US banking system) Same surveillance, lower costs, faster payments.
- atemerev 6y ago
  Bitcoin already works for cheap international transfers. And no, my bank won’t give any details about my account and its transactions (unless I do something really horrible), even to the national tax authorities (I live in Switzerland, where bank secrecy is still a thing, at least for the residents/citizens).
  - vinay427 6y ago
    This is generally true in Switzerland as you stated (with those exceptions for more serious issues) for residents, as Swiss citizenship is irrelevant. Anyone resident in any of a host of countries with which Switzerland has signed agreements can have their bank details shared with the country of residence. I suspect a fair amount of other countries have this discrepancy as well. Based on a brief online search it seems like the data on US checking/savings accounts of US residents are not shared with the IRS, for instance, unless a summons (which can be contested) is approved. I'm not sure what the difference is in practice.

Kednicma 6y ago

Great idea; let's have USPS administer it, like they used to do for money orders and wire transactions. No sense in replacing Mastercard with Google.

kadoban 6y ago
The USPS doesn't seem like it's going to exist in a few more months.
- not2b 6y ago
  Killing it will hurt rural areas, Trump's base, far more than urban areas, where there are other possibilities to get things delivered. If it's destroyed, the guilty party (Trump) will be destroyed, and it will be put back together next year.
dodobirdlord 6y ago
I think this is an excellent suggestion, assuming the post office survives an ongoing calculated attempt to cripple and privatize it. Routing digital payment requests to bank addresses is a natural extension of the responsibility of routing all physical mail to any physical address.
- patmorgan23 6y ago
  I think the Fed is a better place to administer this. It already does checks and ACH payments.
- deleted 6y ago
  [deleted]
smart_jackal 6y ago
Except that UPI is a payment standard, Google neither has monopoly over it nor the only one payment company who supports UPI in India, there are many others like Paytm, Phonepe, Mobikwik, etc.
PaulDavisThe1st 6y ago

galaxyLogic 6y ago

It takes like 3 days to pay my Chase credit-card from my Citibank account. Lots of waste happening in the financial system.

yokaze 6y ago
AFAIK, that's not waste, it's intentional. That's three days of that money out of your books, and on the banks side.
- ckdarby 6y ago
  While this is true a lot of banks would like to do it instantly as it would be an advantage over others and drive more people to sign up for the feature. The real problem is most banks backend systems are still old mainframes where this isn't possible. Source: I'm a prior developer at multi-billion dollar payment processor working with many acquirers.
  - orf 6y ago
    > The real problem is most banks backend systems are still old mainframes where this isn't possible. The rest of the world manages it. Do they not use mainframes?
    - tialaramex 6y ago
      In the UK at least the answer was government fiat. Faster Payments is the unimaginative name for the rule that allows most UK bank account holders to move money the same day (typically in reality instantly) at zero cost to them. The date for Faster Payments becoming possible was set, and banks are just obliged to provide it. Some were earlier, most were not. The banks did not actually implement the underlying backend transfers in time, but customers don't care. Rick Smith, father to an 18 year old daughter who seemingly always needs another few hundred quid for something wants to send Beth £750 right now, and Beth wants to be able to spend that money when she receives it from her father. Neither of them cares that Rick's and Beth's banks are running different versions of some 1970s COBOL application or are struggling to ensure a backend funds transfer matching the Rick-> Beth transaction happens in a timely fashion. So the banks just faked the UX. This technically means if Rick's bank fails after Rick sent the money, but before the backend catches up in a day or two, Beth's bank (but not Beth or Rick) could lose the value of the transaction because the underlying money actually didn't go anywhere yet, just the two account balances were updated. But regulators reasoned that banks being more likely to freak out and report if they suspect their competitors are struggling and likely to fail imminently is a good thing so let them take that risk. Maybe they have subsequently fixed their backends, maybe they didn't, as an end user I needn't care so I paid no further attention.

Finster 6y ago

The big concern I have here is that the address resolution seems similar to DNS... Which is very bad, IMHO. Are they taking necessary steps to mitigate ddos and Man in the middle attacks? If they're not, they're seeing themselves up for major disaster.

godelmachine 6y ago
>>Just like how domains get resolved to IP addresses, every VPA needs to be linked to a bank account. The UPI handles get resolved to bank accounts and IFSC during the payment (we will see how). I am sure I am missing something. Just curious to know where do you see an attack vector for DDoS or MOTM attack?
arafsheikh 6y ago
I don’t know about UPI, but those concerns can be mitigated by not operating on public networks. The SWIFT payment network for example is private[1] and is only accessible via dedicated routers. [1] https://www.exalog.com/en/swiftnet-network-banking-communication https://www.exalog.com/en/swiftnet-network-banking-communica...
- closeparen 6y ago
  Relying on perimeter security like this means you are as vulnerable as your weakest nodes. SWIFT can be and has been hacked via its less sophisticated participant banks.
ta2987 6y ago
> Which is very bad, IMHO. Not humble enough not to shit on something you admit you don't know much about.
sudeepj 6y ago
> Are they taking necessary steps to mitigate ddos I am not sure how this would happen in this case. If you want to flood the system you will have initiate a lot of payments which will be costly. Both sender and receiver are authenticated with bank, so there is a traceability. Also, you need a bank license from the central bank to act as a bank and each UPI is linked to an bank account which itself is linked to details. To add, it is now difficult (not impossible) to have anonymous bank account because they are linked to a central ID called Aaddhar number [1] and other KYC procedures. One will have to really execute an elaborate scam like in Ocean's 11 movie to make this work. [1] https://en.wikipedia.org/wiki/Aadhaar https://en.wikipedia.org/wiki/Aadhaar

filleduchaos 6y ago

It amazes me how seemingly behind US banking is tech-wise. My home country for instance has the Nigerian Inter-Bank Settlement System for decades; it's quite similar to the UPI but primarily led by the central bank (plus participation is mandatory for all banks/bank-like institutions). For anyone that's curious, the platform's home page at https://nibss-plc.com.ng/ https://nibss-plc.com.ng/ has a nice little statistics summary of both POS and account-to-account transactions (you might have to scroll past the fold). There's five-minute and whole day numbers for total transactions and error rate broken down into types of errors - it's a nice bit of transparency.

blisseyGo 6y ago
I think US (and other western countries like Canada, European countries etc) are VERY different from the Indian market. In US, Canada etc, everyone has an email and banks allow interactive payments already. I have yet to have a single time where I had problems paying someone for something. Interac etransfer works well. Even iMessage, FB messenger etc allow payments. Other services like PayPal, Stripe, Patreon cover the rest of the base. India is a completely different market. There are millions of people there who don't even have a bank account, nor do they have email. The road-side vendors use cash.
- filleduchaos 6y ago
  The other thing that amazes me is how quickly people will jump to defend the US' hodge-podge of third-party walled garden options. I've been able to send near-instant account-to-account transfers for a decade, for a stamp charge capped at the equivalent of about thirteen cents, via a first-party platform that every bank or bank-like institution is required to be part of. So yeah, "options" like "join Facebook" or "wait a couple business days for your transaction to be complete" or "pay (comparatively) exorbitant fees" will always sound inherently ridiculous to me. To my knowledge the situation in the US is getting better with the rise of Zelle, but that's still a half-assed solution - not all institutions participate, and customers have to opt in to it. Quite a few (older) people I've talked to don't even know it exists. > India is a completely different market. Ironically you are quite close to getting the point here, which is that India (and many other developing nations) are able to build and push the cutting edge of national fintech precisely because they don't have decades if not centuries of cruft and technical debt weighing them down. They can skip the inefficient stages of development that developed nations went through and go straight to creating banking systems for the 21st century.

zimbatm 6y ago

The article looked great until the introduction of the NPCI system. It's essentially a single point of failure, and the best place to observe all the transaction of the whole country. It's controlled by the Government so it will be really tempting to peek into it. > Imagine the pain that everyone has to go through in reaching a consensus when configurations or infrastructures change. It would be chaos. Welcome to the Internet.

themacguffinman 6y ago
So is the Federal Reserve, so is the SEC, so is the IRS, so are all the financial reporting laws that require transactions to be reported to the US government for audit and regulation. I fail to see how NPCI is any different. The solutions won't be any different either: the government has laws restricting unregulated access to data and developers will implement access controls to enforce these laws. The financial system in practically every country is already fully controlled by a central authority, and for good reason: finance is critical to national security and financial decisions are inherently political, therefore finance is controlled by political authorities.
- captn3m0 6y ago
  You are wrong on one very important point: NPCI is a non-government entity. It is a not for profit corporation that acts as a conglomeration of banks. The government gets a day in it by 1. owning public sector banks and 2. By regulating it indirectly as RBI (which is itself quite autonomous). It is more akin to a not for profit VISA than the Fed Reserve.
  - themacguffinman 6y ago
    > NPCI is a non-government entity Fair correction. However, correct me if I'm wrong, it still plays the role of a singular national authority blessed by the central bank. I'm skeptical that its non-government status is an important distinction when it appears to be an exclusively Indian institution co-established by the RBI. I don't think Visa's status is quite the same: Visa has actual competitors and operates under many foreign jurisdictions. I'd say the NPCI is as trustworthy and protected as the government institutions that bless it.

deleted 6y ago

[deleted]

quarantine 6y ago

This looks like a Bancontact/SEPA combination.

not2b 6y ago

I've made five trips to India for business, the most recent was in 2017. The system that was instituted just before my last trip caused me major problems, as suddenly two things happened: foreign credit cards were no good for payments online (I had to get a colleague to buy my Taj Mahal ticket online and pay him back with cash), and it was suddenly much more difficult for some people I was trying to pay to accept payments in cash; restaurants and hotels could still get it done, but for others it was a major problem. I hope they have these issues straightened out by now.

dheerendra73 6y ago

As a UPI user who is using this from literally day 1 and who is hard core advertiser of this, here are few important points: 1. Security: Signup requires phone number validation via SMS and phone number must be registered with bank. It also requires additional details like debit card validation. This makes is hard to spoof. After signup your device finger print is stored with NPCI and this works as 1st factor. An additional PIN is also required during signup. You can send money only from registered device and requires fingerprint and pin validation. 2. Every digital transaction in India triggers SMS, so that provides additional transparency to user. 3. All payments are from bank account to bank account and they happen in real time! Also no transaction fee! 4. Merchants require no special equipments and they advertise their VPA usually via QR code in shops so it’s easy for users to pay. 4. Online payments can be either user triggered or can be requested via pushing payment request to user app. However user needs to approve the request with pin. Point 3 & 4 were the biggest reasons why India adopted it pretty quickly. Also ofcourse due to Jio boom & cheap chinese smartphones!

9nGQluzmnq3M 6y ago
Q: If a phone number has to be registered and validated, why not use that as the unique ID, instead of creating a separate VPA? For comparison, in Singapore, the local UPI-like "PayNow" network uses numbers as IDs, meaning you can easily send money to anybody in the system (these days virtually everybody) without needing to know their bank. You can also transfer to any Singaporean company or organization via their Unique Entity Number, which is an existing company/org ID assigned at formation that includes a checksum. https://abs.org.sg/consumer-banking/pay-now https://abs.org.sg/consumer-banking/pay-now
- actuator 6y ago
  From my understanding, I think just your phone number/VPA is enough to send money. I am not sure how it works in practice but I assume the VPA concept is there so that your phone number is not exposed if you don't wish to.
  - captn3m0 6y ago

zorro58 6y ago

UPI is a fascinating battle field of tech companies. I had a front seat to some of the negotiations happening to build platforms on UPI. There was a fear in India that foreign tech companies would monopolize that platform. Concurrent with negotiations to build on UPI, there were also leaks and stories by both sides in the press to bolster or communicate positions. For example, there was one story where an official said that a tech CEO made a commitment. The tech CEO did not make that commitment. That company's team had their own set of meeting notes confirming their position. Other companies were livid with the tech company for supposedly taking that position. With the story now published, the tech company could not publicly deny the story or else they would anger the other side. So they quietly rolled with it. It is also a credit to PayTM's CEO. Their CEO saw that succeeding with UPI was a matter of survival. Backed up against a wall, he fought back against his competitors with everything he had and is winning so far. Someone needs to write a book on the behind the scenes happenings.

akritrime 6y ago
That's so fascinating. If I wanted to know more about this side of Indian fintech, where should I start?
- captn3m0 6y ago
  Read everything by Arundhati on The Ken. She covers fintech extremely well.
signal11 6y ago
> winning so far Given PayTM’s losses[1,2], I find “winning” an odd choice of words. The reality is that digital payments in India experienced an artificial “bump” following India’s ill-thought demonetisation experiment, which has evaporated since. And what growth there is, is on vendor-neutral UPI (which Facebook, Google, Jio et al can all use) rather than proprietary e-wallets like PayTM. [1] https://timesofindia.indiatimes.com/business/india-business/paytm-cuts-losses-20-as-e-pays-fall/articleshow/75260576.cms https://timesofindia.indiatimes.com/business/india-business/... [2] https://www.livemint.com/companies/news/paytm-sees-its-losses-surging-in-2019-20-1550425042400.html https://www.livemint.com/companies/news/paytm-sees-its-losse...

throwaway432334 6y ago

Engineering wise, it's a miracle that UPI works. All of the banks have very little in the way of consistency checks and proper abstractions. Everything is superglued together and very brittle. There was clearly little direct communication between NPCI, the issuing banks, and the users of the apis in development. I agree with India's protectionist attitudes that's kept Western companies from monopolizing the ecosystem though. It works well enough, much to chagrin of SV tech companies lol.

varbhat 6y ago

UPI is not nice. 1) UPI is unreliable. Based on my experience, it doesn't work many times per day. I once needed to beg my friend to pay for me after realizing that it didn't work when i purchased something in shop but had no money(only upi account) 2) It is closed source. UPI forces every App that uses UPI to use it's closed source code. 3) I find Bank transfer like IMPS/NEFT more reliable than UPI. 4) One advantage of UPI is it's id which led to discovery of account (through qr code) . This is also the reason it got adopted by people.

iKevinShah 6y ago
"UPI is unreliable" Not saying it is 100% reliable, but there's a good possibility the aggregator you are using (GPay / PhonePay / etc.) might have issues on the whole or with the account.
- abtom 6y ago
  In my experience it's usually the bank having an issue on their end. If you try to make a transaction late at night, say 2am, there's a good chance your bank is "down for maintenance". My account is with a public bank, not sure if this is true for private banks. Either way, reliability varies from bank to bank. One reason behind this (communicated to me by a friend who has some insight into the banking system) is that the government has prohibited charging for UPI transactions. So every bank needs to maintain the infrastructure to integrate with UPI but don't make money off it. This leads some to not treat it with priority (a good to have, not a necessity) or treat it like IMPS/NEFT/RTGS (which only work in a fixed time window). Overall the reliability is still quite good and with increasing reliance of the masses on it, it will hopefully get better.
  - vinay_ys 6y ago
    UPI usage/traffic has grown orders of magnitude each year. That kind of growth isn't handled reliably by the best of the startups even today (remember twitter in its early years?). Banks do invest a lot of money/resources into running/managing UPI but that alone isn't enough. There is no substitute for time and experience (talent) that's needed for the culture change within bank IT teams to mature, and their leadership teams – they have to shift their thinking to deal with the pace of growth and frankly the pace of changes as well.

sandGorgon 6y ago

It is a super exciting time to be doing fintech in India. Here are the open APIs. UPI = Venmo + Paypal UPI Autopay = open credit card subscriptions pull PCR = Open FICO+Equifax NBFC-AA = Open Plaid Digilocker = Open docusign+dropbox OCEN = Open Lendingclub Together, they are called IndiaStack (along with our upcoming health and drone apis).

kumarharsh 6y ago
Plus Aadhaar, eSign, and eKYC

Abishek_Muthian 6y ago

I tell about UPI to my friends in Western countries, When they tell how easy and seamless Apple Pay has made their payments, they're often surprised that such system exists here. One can download GPay or plethora of other apps to setup UPI to sync with the bank accounts within minutes and conduct transactions. With vernacular support/affordable cellular data, these apps have found its users even among those who have never used a computer in their life to login to their banking portal or used debit card before to conduct any online transactions earlier. Now, what 'I' don't like about it, Extraordinary dependence on 'Mobile Number' for security, RBI(India's central bank) requires personal phone number to be synced with the bank account, so these 'UPI' apps send SMS from the phone at random to 'verify' that it's actually you i.e. if the phone number matches its you. If you are like me, who has the phone in aeroplane mode 24*7 or use cellular on-demand be prepared for transaction failures at best to getting locked out of the UPI apps at worst. Then there is the question of SMS OTP as the backbone of Indian banking infrastructure's 2FA security, we know SIM-Jacking attacks are getting prevalent every passing day, coercing an employee of a Telecom who earns minimum wage is not that difficult and especially since there is zero 'cyber-security' awareness among much of the population; attackers just dupe many of them into giving them the OTP[1]. It's high time banking infrastructure here start supporting hardware tokens or at least TOTP apps and UPI has to hedge its unique id dependence to email id as well. [1]https://economictimes.indiatimes.com/wealth/save/beware-of-these-6-frauds-while-making-payments-via-upi-amid-lockdown/articleshow/75671798.cms https://economictimes.indiatimes.com/wealth/save/beware-of-t...

achow 6y ago
> these apps have found its users even among those who have never used a computer in their life The only internet connected device these users have are the cheap smartphones and within the phone perhaps only complex apps that they are familiar with is messaging (apart from entertainment and 'selfie' related ones). So any other authentication mechanism (email or others) would see the usage plummet.
- Abishek_Muthian 6y ago
  >So any other authentication mechanism (email or others) would see the usage plummet. True, but Security > Friction; especially when it comes to hard earned wealth in a poor country like ours, where even daily wage earners use UPI now, especially because of COVID-19 induced lockdowns(COVID-19 themed UPI frauds for OTP are also increasing at the alarming rate for the same reason). More over email is Federated, not owned by any single entity, I can run my own email infrastructure with minimal expenditure if needed. But for phone number itself I have to depend upon a Monopoly, Duopoly or an Oligarchy at best who if needed can screw me up if they want at anytime.

pedrocx486 6y ago

Brazil is doing a similar bank-agnostic system called PIX. Kinda interesting how in the previous thread where I mentioned it a lot of people were against it because it was "not competitive" while here I'm seeing (mostly) praise for UPI. IMHO, this is how it should be, a bank-agnostic standard set by the central bank that other services use to connect to the central and with each other. Competition is good? Yes, but not when it's a complete mess.

perryizgr8 6y ago

I love UPI and it has proved to be a boon in this time when I am scared of touching cash. It's very fast, easy and quite reliable in my case. In Bangalore, it works literally everywhere. From the smallest shops to big supermarkets. Many small shopkeepers even discourage me from paying in cash. But people need to realize one aspect of UPI that it is exactly as unsafe as cash. Would you send cash to someone over the phone for accepting delivery of a product later? No. So don't do that with UPI. Use UPI when it would be appropriate to use cash, when you're standing face to face with the seller. Just think of it as more convenient cash. Otherwise, it is ripe for exploitation by thieves.

blueblisters 6y ago
> Just think of it as more convenient cash. Yup exactly. As someone mentioned above, it's a frictionless payments system, unlike Visa/Mastercard which also offer dispute resolution. Of course, if you trust the vendor, I don't see why you should implicitly pay for the protection mechanism of Visa/Mastercard when UPI is literally free.
- captn3m0 6y ago
  > when UPI is literally free So far. Lots of banks are fighting to introduce fees. The actual cost is getting subsidised so far, but there are no free lunches. Banks can't keep this up forever.

sseth 6y ago

UPI is growing at an incredible rate. One important reason for the growth is the explosive increase in 4G connectivity in the last 4 years, which has data usage on mobile see a compound average growth of 93% to become the highest in the world at 11.2 GB per user / month. The rates are almost laughably cheap, at around 0.20 USD/GB. COVID has also driven more recent growth because people don't want to handle cash.

gingerlime 6y ago

Slightly OT, but what's the simplest way to offer more payment options online in India? Is there a way to set up UPI as a foreign company? For context: we're a small B2C bootstrapped company offering online anatomy learning. We use Stripe and Paypal (via Fastspring), but it seems like it's far from enough for the local market in India...

pkphilip 6y ago
The best option is to tie up with a payment gateway like Razorpay, Instamojo etc. They allow a variety of payment methods including UPI and also what is called "Net Banking" - which is direct transfers from a bank account even without UPI being used. They also support a variety of wallets. Instamojo actually advertises that they support over 100 payment methods. Some of these payment gateways also allows you a "Pay Later" option which allows the user to pay via a micro loan that they take from the gateway. This is apart from the credit card, debit card options. Razorpay: https://razorpay.com/payment-gateway/ https://razorpay.com/payment-gateway/ Instamojo: https://www.instamojo.com/ https://www.instamojo.com/
- captn3m0 6y ago
  Razorpay only supports merchants registered in India. Disclaimer: I work at Razorpay.
  - pkphilip 6y ago
    True. They will need some sort of an Indian subsidiary or go through an Indian registered company to allow Razorpay or Instamojo payments
    - gingerlime 6y ago
      Thank you. I’m not sure that’s an option for us unfortunately. Unless you know of some stripe atlas equivalent service for setting up a company in India?

lonesword 6y ago

As an Indian citizen living in Germany right now, I sorely miss UPI. My workflow to order food in India - 1) open app and add things to cart 2) Google Pay (linked to UPI) prompts for my fingerprint and that's it. In Germany, I mostly end up using SOFORT which involves remembering my account number, pin, and then using a mobile OTP. There's no "easy" way to transfer money to friends - everyone either uses paypal or Transferwise, which requires an additional step to withdraw funds to your bank account. When shopping at brick and mortar shops, the payment options are either cash or a card. For a country that enjoys such a high standard of living, Germany has surprisingly underwhelming digital banking infrastructure.

vishnugupta 6y ago

RBI recently issued a circular inviting companies to build a retail payments network, in parallel to UPI [1], under New Umbrella Entity (NUE). Two key aspects of NUE are, it could be a for-profit, and it'll be governed by India's FDI rules, meaning foreign investments are allowed and could even be encouraged as FDI rules get relaxed. Both these are in direct contrast to NPCI's charter which is a not-for-profit and entirely owned by Indian entities. In fact NPCI is a quasi government organisation, owned by a combination of RBI and Indian banking association. Google (through its India subsidiary) has already applied for building/operating an NUE, and I won't be surprised if Facebook has done it too. I just hope that 20 years down the line we won't end up with a fragmented quagmire with half a dozen payment networks each of which don't talk to anyone else. UPI solved a huge problem of interoperability and it'll be a shame if its seamlessness is squandered away. [1] https://www.rbi.org.in/scripts/bs_viewcontent.aspx?Id=3832 https://www.rbi.org.in/scripts/bs_viewcontent.aspx?Id=3832

wtmt 6y ago
> Both these are in direct contrast to NPCI's charter which is a not-for-profit and entirely owned by Indian entities. By Indian entities, if you do include Citibank and HSBC (local arms), then yes. The promoters are private and public banks. > In fact NPCI is a quasi government organisation, owned by a combination of RBI and Indian banking association. It's promoted by RBI, but not really owned by it. The ownership lies with the consortium of private and public banks.

known 6y ago

Remembering Bank A/c number + IFSC is safe/better

rootkea 6y ago

The best feature of UPI for me is that it provides USSD code (*99#) to interact with the UPI. Since I only use FLOSS apps (via f-droid.org) on my LineageOS I use UPI without installing any UPI app (which all are proprietary e.g. PayTm, Gpay etc.).