[nishsingh]

I love my Samsung pay. It is always available on my Samsung phone with an easy swipe-up. In addition to UPI, I can add wallets like Paytm, Mobikwik, etc in addition to all my credit cards. I can simply choose which payment option or credit card to use depending on the offers running at the merchant store.

(Cards work via NFC or via MST, so almost all machines worked with Samsung pay.)

Samsung Pay has been around for a while, in fact even before demonetization. However, Samsung failed to publicize it enough and cash in on the demonetization. (pun unintended)

Here's an old video showing Samsung pay in action -

https://www.youtube.com/watch?v=9WztSz6wTQg&t=57s

[viggienomad]

Initially PayTM, then Tez/Gpay, now alternating between Gpay & PhonePe. On one occasion, Gpay read a QR code of one eatery but showed another eatery name in next street. That QR code was from PhonePe, I exited & closed the app from background also, opened it again. Gpay consistently returned the other name. The eatery owner had no clue.

We (the eatery owner & myself) decided to make a test payment of Re.1. The eatery owner haven't received money. Not sure whether the other eatery next street got it. Didn't checked. PhonePe showed their name correctly.

So I'm now using PhonePe if QR code is by that company. I must admit that using PhonePe is much smoother, intuitive than Gpay. Those cashbacks in these 3 apps are a mockery now.

Some posts here voiced about security of apps. From my understanding, these apps are only a front. The actual UPI transaction is handled by NPCI - which also created RuPay, runs NACH (National Automated Clearing House), IMPS & Bharat Bill payment System. These third party apps (PayTM, Gpay, PhonePe) can make UPI transaction only through a participative bank. So my assumption is it's reasonably secure.

[theunstabledesi]

Originally Posted by Dr.Car

Respect all the points you mentioned but Phone Pe just has an Indian name. As far as I know, it's owned by Flipkart which in turn is a wholly owned subsidiary of Walmart Inc. based in the USA. Please correct me if I am wrong.

yes you are totally right. However, it was founded by Indians in 2007. Walmart acquired a majority stake somewhere in 2017/2018.

[binand]

Originally Posted by mayuresh

Visa and Master are for-profit corporates. NPCI is non-profit, part of payment infrastructure of the country.

Yes, thanks. That distinction is well-appreciated.

Originally Posted by viggienomad

On one occasion, Gpay read a QR code of one eatery but showed another eatery name in next street. That QR code was from PhonePe, I exited & closed the app from background also, opened it again. Gpay consistently returned the other name.

Are you sure the field executive made a mistake; they placed the other eatery's code in this one?

Originally Posted by GeeTee TSI

A practical difficulty observed is that there could be someone peering over my shoulder as I type the UPI PIN at a crowded counter.

The UPI PIN is one of two factors in the two-factor authentication system implemented. Learning it alone doesn't help an attacker / fraudster - they need to get access to the other factor (your SIM card) also. As long as you have protected yourself from that risk you are OK. So keep a strong unlock PIN/password for your mobile and - many people miss this - set a PIN lock for your SIM card too.

Also practice changing the UPI PIN every so often, treating it like a password.

Originally Posted by GeeTee TSI

BHIM [...] is probably the only UPI app which allows direct transfer to an account number + IFSC code...

I think this is a feature of UPI and is supported by all the clients?

[msdivy]

My experience:
Started off on Android. GPay required the location to be on, it was a hassle. Also since I was facing frequent failures, I switched to Amazon Pay, which worked flawlessly for a few years. When my Android was dying due to age, Amazon pay was failing to load. I cursed the developer who designed Amazon Pay interface - it is very heavy and it would take ages to load and finally scan would fail. I switched to WhatsApp pay, which has a light interface and worked quite well till I switched to iPhone.

In iPhone surprisingly WhatApp payment was failing frequently. I switched to GPay and is working flawlessly. Sometimes I do use Amazon Pay but Gpay is faster. Location is not a concern since it is on by default on iPhone.

All the above apps require a PIN for UPI. HDFC Bank app UPI doesn't require a PIN. Just unlocking the phone with biometrics is enough. This would have been convenient but that app is not designed for UPI payment and takes a few additional steps to scan and complete the payment.

PS: Appreciate the NCPI's effort in digital payment starting from 2009, in the form of IMPS & UPI.

[mayuresh]

Originally Posted by GeeTee TSI

BHIM for it's rather clunky UI is probably the only UPI app which allows direct transfer to an account number + IFSC code (without registering them as a payee)

No. acno + ifsc is a part of UPI protocol right since its inception.

Moreover even if you don't choose a VPA, every account automatically gets the following VPA:

<acno>@<ifsc>.ifsc.npci

Most well behaved apps support this VPA, some don't. I have been watching this over years and the support has improved of late in most of the apps.

I use above form to (semi)automate UPI payments for a small business using payee account details in the CRM to include parties that don't have a VPA. A utility I wrote generates QR codes one by one, with amount, comments and payee, all pre-populated for all payments to be made and those are effected using any UPI app manually.

[binand]

Originally Posted by mayuresh

every account automatically gets the following VPA:

<acno>@<ifsc>.ifsc.npci

The following are other special VPAs (ie, resolved directly by NPCI) that are in various stages of implementation:

<aadhaar-no>@aadhaar.npci to pay someone using their Aadhaar number (can't think of use-cases for this outside of government circles, though).

<mobile-no>@mobile.npci, same for mobile numbers. Hopefully they will expedite the implementation of this one because right out, paying with only a mobile number is a bit of a mess.

<card-no>@rupay.npci, for Rupay cards.

[Chetan_Rao]

Originally Posted by msdivy

... HDFC Bank app UPI doesn't require a PIN. Just unlocking the phone with biometrics is enough. This would have been convenient but that app is not designed for UPI payment and takes a few additional steps to scan and complete the payment...

ICICI app is great that way. Has a 'scan to pay' option in the tap & hold app menu, goes directly to a biometric authenticated checkout page.

Select 'Scan to Pay' > Enter amount > Authenticate > Done.

Cleanest UPI interface I've seen so far.

[huntrz]

Originally Posted by mayuresh

Third party apps aren't allowed to use OTP. Only the bank's app for its own a/c can use OTP. PIN isn't known to the app. Apps are scrutinized and approved by NPCI.

There are reasonable precautions and things are getting robust with usage. But can things break still? Yes - it can't be ruled out. But then any other digital transaction method carries similar risks as well. (Even non-digital methods do, but that's too much of off topic.)

I know it may sound fool proof now. That is why I said we can't anticipate in advance until some one finds a way to con. Lot also depends on security of the platforms itself on which apps are running. OTP , pin, fingerprint all go through the platform and access to it is a matter of permission. Too many moving parts to secure here. Less the number of moving parts less the chances of failure. As for tech related matter I don't really trust any govt department. Despite all the checks, balances, security audits and gurantees banks still fail, credit card details still leak, the less number of organizations have the access or details to the account the better it is. If you feel safe using it, nothing better. I was just putting across my thoughts.

[ninjatalli]

Originally Posted by Chetan_Rao

Select 'Scan to Pay' > Enter amount > Authenticate > Done.

Cleanest UPI interface I've seen so far.

Both Gpay and Paytm offer the above, and also the option to 'pay a mobile number' in a similar manner - the number of steps is same for both apps and both options (although paytm has an extra step for paying a mobile number). I'm sure PhonePe and other apps also offer this facility.

Practically all apps kind of replicate any feature offered by the other app these days.

[mayuresh]

Originally Posted by huntrz

I know it may sound fool proof now. ... If you feel safe using it, nothing better. I was just putting across my thoughts.

There is nothing called absolutely secure. It's more a matter of how probable it is to hack. This applies to ALL methods of doing transactions including currency notes, not just UPI.

[msdivy]

Originally Posted by ninjatalli

Both Gpay and Paytm offer the above, and also the option to 'pay a mobile number' in a similar manner - the number of steps is same for both apps and both options (although paytm has an extra step for paying a mobile number). I'm sure PhonePe and other apps also offer this facility.

Practically all apps kind of replicate any feature offered by the other app these days.

Doesn't GPay ask for PIN? How to disable asking for UPI PIN?

[mayuresh]

Just want to add a couple of points to the thread:

1. I didn't see anyone mention SBI BHIM app on the thread. No, nothing fancy with it to mention. Just that in my experience, many times when other apps including BHIM deny a transaction SBI BHIM goes through. I have no idea why this happens, but on quite a few occasions it has happened.

2. Do choose the app that shows the payee account name automatically. These days most apps do, but many are still lacking this important feature. No matter whether you are using VPA or a/c no, the UPI infrastructure provides this information to the app which acts as a double check before you pay.

An aside. Incidentally, this features (of showing name for given a/c no) is also available for payment modes other than UPI - such as NEFT - at infrastructure level. Just that not too many banks have implemented it. IDFC for one was quite early to implement this.

[viggienomad]

Originally Posted by binand

Are you sure the field executive made a mistake; they placed the other eatery's code in this one?

The QR code showed the eatery name correctly in PhonePe & the payment made in PhonePe reached the owner. So I guess it's not an error by field staff. Further the owner said he received payment from other UPI apps too. Not sure how it happened.

So I now crosscheck their name when I'm paying to footpath vendors (flower / tender coconut / fruit etc). In Bengaluru, they usually don't check their app while receiving UPI payments.

[ninjatalli]

Originally Posted by msdivy

Doesn't GPay ask for PIN? How to disable asking for UPI PIN?

There are two pin requirements; for entering into the app and for authenticating the transaction.

The former can be changed to biometric in the security settings. The latter is mandatory on every app, unless you have a wallet linked and use it instead (e.g. possible in Paytm).