UPI: India's Unified Payments Interface
I tell about UPI to my friends in Western countries, When they tell how easy and seamless Apple Pay has made their payments, they're often surprised that such system exists here. One can download GPay or plethora of other apps to setup UPI to sync with the bank accounts within minutes and conduct transactions.With vernacular support/affordable cellular data, these apps have found its users even among those who have never used a computer in their life to login to their banking portal or used debit card before to conduct any online transactions earlier.Now, what 'I' don't like about it,Extraordinary dependence on 'Mobile Number' for security, RBI(India's central bank) requires personal phone number to be synced with the bank account, so these 'UPI' apps send SMS from the phone at random to 'verify' that it's actually you i.e. if the phone number matches its you. If you are like me, who has the phone in aeroplane mode 24*7 or use cellular on-demand be prepared for transaction failures at best to getting locked out of the UPI apps at worst.Then there is the question of SMS OTP as the backbone of Indian banking infrastructure's 2FA security, we know SIM-Jacking attacks are getting prevalent every passing day, coercing an employee of a Telecom who earns minimum wage is not that difficult and especially since there is zero 'cyber-security' awareness among much of the population; attackers just dupe many of them into giving them the OTP[1].It's high time banking infrastructure here start supporting hardware tokens or at least TOTP apps and UPI has to hedge its unique id dependence to email id as well.[1]https://economictimes.indiatimes.com/wealth/save/beware-of-t...