How UPI Actually Works

← Blog

What really happens in the two seconds after you tap Pay, and why paying a friend and paying a shop are not the same transaction.

You scan a QR code at a chai stall. You type 20. You enter your PIN. Somewhere behind you a little speaker says "twenty rupees received."

That took about two seconds. In those two seconds, your phone talked to an app company, the app company talked to a national switch, the switch talked to your bank, your bank moved money, the switch talked to the shopkeeper's bank, and a confirmation travelled all the way back to both of you.

India did this 24 billion times in September 2026 alone.

Most of us use UPI more often than we use the word "UPI." Very few of us know what it actually is. And as of October 15, that gap matters a bit more, because for the first time some UPI payments now carry a fee.

So let's open it up.

UPI is not an app

This is the first thing to get straight. Google Pay is not UPI. PhonePe is not UPI. Paytm is not UPI.

UPI is a set of rules and a central switch run by the National Payments Corporation of India (NPCI). Think of it as a highway. The apps are cars. The banks are where the money actually lives. NPCI owns the road and the traffic signals.

Every UPI payment involves up to four parties:

The payer's app (the PSP, or Payment Service Provider): the app you open to pay.
The payer's bank (the remitter bank): where your money actually sits.
The payee's app and bank: the same two roles on the receiving side.
NPCI's UPI switch: sitting in the middle, routing every message.

Here's the part people miss. Your money never goes "into" Google Pay or PhonePe. The app is a remote control. It sends instructions. Your bank does the debit. The other bank does the credit. The app never holds your rupees.

That one design choice is why UPI scaled the way it did. Any bank could join. Any app could build on top. Nobody had to trust a wallet company with their salary.

Your UPI ID is a nickname, not an account

When you pay rahul@okicici, you aren't sending money to an account number. You're sending it to an address, a VPA (Virtual Payment Address).

The part after the @ is called a handle, and it tells NPCI which app (PSP) knows who Rahul is. That app holds the mapping from "rahul" to an actual bank account and IFSC code.

This matters for two reasons. First, you never see anyone's account number, which is a big privacy win. Second, Rahul can change the bank account behind that ID without telling anyone.

Translating a nickname into a real account is called address resolution, and it happens on every single payment.

P2P: paying a friend

Person to person. You owe your friend 500 for dinner. Here's what actually happens after you tap Pay.

Step by step

1. You authorise. You enter your UPI PIN. Your app never sees it in plain form. It's encrypted on your phone using NPCI's library before it leaves the device.

2. Your app sends a pay request to NPCI. In UPI's own language this message is called ReqPay. It says: this person, from this address, wants to send 500 to that address.

3. NPCI resolves the address. It looks at @okicici, asks that PSP who "rahul" is, and gets back the real account details.

4. NPCI asks your bank to debit you. Your bank decrypts and checks your PIN, checks your balance and limits, takes 500 out of your account, and tells NPCI "done."

5. NPCI asks Rahul's bank to credit him. His bank adds 500 and confirms.

6. Confirmations go back. NPCI tells both apps. You see the tick. Rahul gets the SMS.

You -> Your app -> NPCI -> (resolve rahul@okicici)
                       -> Your bank   : debit 500   -> OK
                       -> Rahul's bank: credit 500  -> OK
     <- Your app <- NPCI : SUCCESS

All of that, in about two seconds, with your money effectively in his account the moment you see the tick.

The one thing that's not instant

Here's a detail most people don't know. Your bank and Rahul's bank haven't actually moved real money between each other yet.

Your bank owes Rahul's bank 500. Rahul's bank has already given Rahul the 500 on trust. The banks settle the net amount between themselves later, through accounts at the Reserve Bank of India, in several settlement cycles through the day.

So "instant" UPI is really instant for you, with the banks squaring up behind the scenes. That's normal for payment systems. It's also why the rules for who can be on this network are strict.

Why P2P is free

Nobody pays anything for P2P. Not you, not your friend. The government has said it plainly: P2P UPI stays completely free, whatever the amount.

That's not an accident. P2P was the habit-builder. It's how a whole country learned to trust a PIN on a phone more than cash in a wallet.

The collect request, and why it got killed

There used to be another kind of P2P payment. Instead of you pushing money, someone could pull it: send you a collect request saying "approve 2,000," and the moment you entered your PIN, money left your account.

You can probably guess what happened. Fraudsters sent collect requests dressed up as "you've received a refund, enter your PIN to accept." People entered their PIN thinking they were receiving money. They were paying.

NPCI shut down P2P collect requests from October 1, 2025. Now, between two people, the only way money moves is the payer pushing it. A boring rule, and one that quietly prevented a lot of scams.

The safest rule in UPI is still the simplest one: you only enter your PIN to send money. Never to receive it.

P2M: paying a shop

Person to merchant. This is where UPI gets more interesting and a lot more complicated.

And it's where most of the volume now is. Of the 24.07 billion UPI transactions in September 2026, 15.22 billion were P2M and 8.83 billion were P2P. That's roughly 63% merchant payments.

The rails are the same: app, NPCI, two banks. What changes is everything around them.

New players show up

A merchant payment usually pulls in a few more companies:

The acquiring bank: the bank that signed up the merchant and receives the money on their side.
The payment aggregator, for most online merchants (Razorpay, PayU, Cashfree, Juspay and others). They sit between the merchant's checkout page and the bank, so the merchant doesn't have to integrate with UPI directly.
The soundbox, for the kirana store. That talking speaker is a small device connected to the merchant's account that reads out every confirmed payment, so the shopkeeper doesn't have to check their phone.

Three ways to pay a merchant

1. Scan a QR code. The most common one. A UPI QR code isn't magic. It's just a link written as a picture. Decode one and you'll see something like this:

upi://pay?pa=shop123@ybl&pn=Sharma%20Stores&am=250.00&tr=ORD8841&cu=INR

The pa is the merchant's UPI address. The pn is the name you see on screen. The am is the amount (on a static sticker QR at a shop, this is usually missing, so you type it yourself). The tr is the merchant's own order reference, which is how they match your payment to your bill.

Your app reads the link and builds the same ReqPay message as in P2P. From there the flow looks almost identical.

2. Intent. When you buy something on Swiggy or Zomato and tap "Pay with UPI," the app opens your UPI app with all of those fields already filled in. Same link format, just passed between apps instead of printed on a sticker. You enter your PIN, and your UPI app hands the result back to the shopping app.

3. Collect from a merchant. On some websites you type your UPI ID and get a request on your phone to approve. This still exists for verified merchants, even though person-to-person collect is gone.

Where P2M gets hard

Paying a friend is basically one event. A merchant payment is the start of a process.

The merchant has to match your payment to an order. They might owe you a refund three days later. They need settlement reports. They need to know, right now, whether to hand you your food.

And that last one is the hardest problem in the whole system: what happens when the answer isn't yes or no?

Every payment engineer knows this one. You entered your PIN. Money left your account. The app says "pending." The merchant hasn't got it. Everyone is staring at the screen.

What usually happened is that somewhere in that chain of four or five parties, one response didn't come back in time. Your bank debited you, but the confirmation timed out before reaching NPCI or the merchant. The system doesn't know for sure if the money moved, so it marks the payment as "deemed" or pending and checks again later using a status query (ReqChkTxn, if you want the name).

If the credit never happened, the money comes back to you automatically, usually within a few days. It's annoying. It's also the system choosing to be safe instead of guessing.

This is the unglamorous half of payments. The happy path takes two seconds. The other paths are where all the engineering effort goes.

P2P vs P2M, side by side

Who starts it: In P2P, always the payer, now that collect is gone. In P2M, the payer by scanning or through intent, or the merchant through a collect request.
Who is involved: P2P needs two apps, two banks and NPCI. P2M often adds an acquiring bank, a payment aggregator, and sometimes a soundbox provider.
What it costs: P2P is always free. P2M is free under Rs 2,000 and now has a fee (MDR) on bigger payments, paid by the merchant.
What comes after: P2P is done once the money lands. P2M brings order matching, refunds, settlement reports and disputes.
What breaks: In P2P, a wrong UPI ID or a scam. In P2M, timeouts, pending payments and refunds that take days.

The money question nobody asked for eight years

Here's the thing about a free system: someone is always paying.

For most of UPI's life, merchants paid nothing to accept it. That's the zero MDR policy. MDR (Merchant Discount Rate) is the cut a merchant gives up on each digital payment. On cards, it's been around 1 to 2% forever. On UPI, it was zero.

So who paid for all the servers, fraud checks, customer support and soundboxes? Banks and apps absorbed the cost, with some help from government incentives. That's why UPI apps kept pushing loans, insurance and ads. The payment itself didn't make anyone money.

That changed on October 15, 2026. The new rules:

All P2P payments stay free, whatever the amount.
Merchant payments up to Rs 2,000 stay free.
Small merchants receiving up to Rs 1 lakh a month through basic QR codes stay at zero MDR.
Merchant payments above Rs 2,000 carry a 0.4% MDR, capped at Rs 300 for payments of Rs 75,000 and above.
Essential sectors like railways, telecom, fuel, insurance and farm inputs pay a flat Rs 5 per transaction above Rs 2,000.
Mutual funds and stockbroking pay 0.02%, capped at Rs 300.

The merchant pays this, not you. Banks have been told not to let merchants pass it on to customers, and apps aren't allowed to add platform fees.

Here's the number that explains the whole policy. Only about 4% of merchant transactions are above Rs 2,000. But those 4% make up about 67% of merchant payment value, around Rs 5.94 lakh crore in September alone.

So the fee doesn't touch your chai or your auto ride. It touches the laptop, the hotel booking and the electronics store bill. A tiny share of payments, a big share of the money.

My take

I think this was inevitable, and mostly right.

A system that moves about 29 lakh crore rupees a month can't run on goodwill and cross-subsidies forever. If nobody makes money moving the money, the only way to make money is to sell you something else on the side. That's how you end up with payment apps that are really loan apps with a pay button.

Charging the big-ticket merchant payments, and leaving P2P and small payments alone, is about the least painful way to do it. The kirana store doesn't feel it. The person paying a friend doesn't feel it.

What I'm less sure about is the capital-markets part. Zerodha and others have already pushed back, and I understand why. Nudging people toward investing, then adding friction to the exact payment that does it, feels a bit backwards even at 0.02%.

And the real test is still ahead. If 0.4% becomes 0.8% in two years, merchants will start pushing customers back to cash or cards for big bills. UPI won because it was the path of least resistance. The moment it stops being that, people notice.

What to remember

The next time you scan a QR, here's what's happening under the hood: your app builds a message, NPCI finds out who the shop really is, your bank takes the money, their bank receives it, and a speaker somewhere says the number out loud. All of it in about two seconds.

Paying a friend is a single clean event that will stay free. Paying a shop is the start of a process, with more companies, more ways to break and, now, a small fee on bigger bills.

Same highway. Very different traffic.

Numbers are from NPCI's monthly UPI statistics (September 2026) and the government's October 2026 notes on UPI MDR. Find me on X.