Starting February 1, 2025, Unified Payments Interface (UPI) apps will no longer process transactions with special characters in their transaction IDs. This directive from the National Payments Corporation of India (NPCI) aims to standardise UPI transaction ID generation by allowing only alphanumeric characters.

If your UPI app continues to use special characters, the central system will decline the transaction.

This change places the responsibility on payment apps to comply and ensure seamless UPI transactions for users.

Experts highlight significant security and performance risks associated with special characters in transaction IDs.

Jaikumar, Co-founder & CTO of TechFini, explains, “Special characters in UPI transaction IDs can lead to vulnerabilities like injection attacks, format spoofing, and data integrity issues. Risks such as SQL injection, Cross-Site Scripting (XSS), and validation failures compromise transaction reliability and system security. Standardising IDs with alphanumeric formats enhances security, prevents fraud, and ensures uniform processing across platforms.”

According to Jaikumar, this change minimises risks, reduces disruptions, and improves interoperability among banks and payment providers.

What users should do

Users should ensure their UPI apps comply with the NPCI directive. Apps that fail to transition to alphanumeric transaction IDs will stop functioning for UPI payments after the February 1 deadline.

This move by NPCI strengthens the digital payment ecosystem, ensuring a safer and more reliable platform for users across India.