UPI: What Happens in the Seconds Between 'Pay' and 'Paid'

You're at a chai stall. You scan the QR code taped to the counter, type 10, enter four digits, and before you've put your phone away a little speaker on the counter says "Paytm par das rupaye prapt hue." Ten rupees received.

In those few seconds, your phone, a payments app, your bank, the chai-wala's bank and a switch run by a company most people have never heard of have all talked to each other. Your bank has checked a PIN it never lets anyone else see. The chai-wala has the money. And nobody, not you and not the stall, paid a single paisa in fees.

Here's the part almost nobody knows: at that moment, your bank still hasn't actually paid the chai-wala's bank. That happens later, in a batch, a few hours from now. The system is built so you never have to care. This essay is about the people who do have to care.

What actually happens when you tap "Pay"

Think of passing a note to a friend across a classroom. You don't throw it; you hand it to the person next to you, who hands it on, and the teacher at the front makes sure every note goes to the right desk. Nobody needs to know where your friend sits. They only need their name.

Brazil's Pix made this idea famous with Pix keys: instead of typing a bank and account number, you pay someone's phone number, email address, tax ID or a random key, and the central bank's directory looks up which account it belongs to. UPI does the same with your UPI ID, or virtual payment address (VPA), something like surya@okbank: a nickname that points to your bank account without revealing the account number. When you pay, the message travels like this:

1. Your app (PhonePe, Google Pay, Paytm, your bank's own app) packages the request: who's paying, who's being paid, how much.
2. It goes to the app's payment service provider (PSP) bank, the bank that sponsors that app onto UPI. Apps like PhonePe and Google Pay aren't banks; in NPCI's language they're third-party application providers (TPAPs), and they ride on partner banks.
3. The PSP bank passes it to NPCI's central switch. NPCI, the National Payments Corporation of India, is the teacher at the front of the class: it knows which bank sits behind every UPI ID.
4. NPCI sends a debit request to your bank (the issuer). Your bank checks your UPI PIN. The app never sees it: it's encrypted on your phone before it leaves, and it's your bank that verifies it. If the PIN is right and the money's there, your bank debits you.
5. NPCI sends a credit instruction to the chai-wala's bank (the beneficiary), which credits the chai-wala's account.
6. Confirmations flow back, and the soundbox speaks.

Two things make this secure without being annoying. Device binding: when you set up UPI, your phone silently sends an SMS from the SIM registered with your bank, tying that phone to that account. And the PIN: something only you know, checked only by your bank. Something you have plus something you know. That's two-factor authentication, done so smoothly most people don't notice it happened.

The money moves later than the message

Now the part in the opening. Think of a school canteen that lets every class run a tab. Through the day, kids from 7A buy from 7B's stall and 7B buys from 7A's. Nobody hands over cash for each packet of chips. At the end of the day, the teacher adds it all up, and 7A pays 7B only the difference.

That's deferred net settlement, and it's how UPI settles between banks. When you pay, your bank debits you and the chai-wala's bank credits the stall immediately: that's why the money is already there. But the two banks don't transfer money to each other for that one payment. NPCI adds up every UPI payment between every pair of banks over a window of time, works out who owes whom overall, and the banks settle that one net figure through their accounts at the RBI, using the RTGS system. UPI runs this in cycles through the day: since November 2025, ten cycles for regular payments, with two more kept separately for disputes. (If the idea of cancelling a mountain of payments into one figure is new, netting explains it in full.)

Countries have made different choices here, and the choice matters.

The United Kingdom's Faster Payments, launched in 2008, made the same one India did: deferred net settlement, with settlement at the Bank of England three times a business day. To make sure a bank can't fail to pay its net bill, UK participants prefund, keeping enough money at the central bank to cover the most they could possibly owe.

Brazil's Pix (launched November 2020) and the US FedNow (July 2023) went the other way: real-time gross settlement. Every payment settles individually and instantly in central bank money, so there's no end-of-cycle bill at all.

India's UPI chose netting for volume: a record 23.66 billion transactions in July 2026, about 76 crore a day. Settling each one individually would mean 76 crore bank-to-bank transfers a day; netting shrinks that to a handful per cycle. The trade-off is a window where the chai-wala has been paid but the chai-wala's bank hasn't. Invisible to you; watched all day by every bank's treasury team. It's the gap between a payment being done and being final.

Why it's free, and who pays anyway

Think of a public road. You don't pay each time you drive on it, but somebody built it and somebody maintains it. "Free" means the cost moved, not that it vanished.

In Brazil, Pix is free between individuals, but banks are allowed to charge businesses for receiving Pix payments, and they set their own prices, generally well below what the same shop pays to accept cards. Those business fees help banks cover the cost of running it.

India went further. Since 1 January 2020, the fee a merchant pays to accept a UPI payment (the merchant discount rate, or MDR) has been set at zero by law. So who pays for the servers, the fraud checks and the customer support?

• The government, partly. For 2024–25, the Union Cabinet approved ₹1,500 crore to pay banks 0.15% on UPI payments of up to ₹2,000 to small merchants. Only 80% is paid automatically; the rest depends on the bank keeping technical failures below 0.75% and uptime above 99.5%. The subsidy is designed to buy reliability, not just volume.
• Credit, increasingly. Since 2022, RuPay credit cards can be linked to UPI, and those payments are not free for the shop: merchants pay an interchange fee of roughly 1–2%, except small merchants on payments up to ₹2,000. It's how "free" UPI is quietly growing a paid lane.
• The banks and apps, mostly. They carry the running cost and try to earn it back elsewhere. That's the whole business model behind Paytm's soundbox and PhonePe's loans and insurance: the free payment is how they get close enough to sell you something that isn't free.

Why UPI grew faster than anything else

Here's the scale gap. The IMF has identified UPI as the world's largest real-time retail payment system, with roughly 49% of all real-time payment transactions globally. Pix, the second great success story, handled about 6.6 billion transactions in May 2025. FedNow handled 8.4 million in the whole of 2025; UPI does more than that in under twenty minutes.

The difference isn't mainly technology. It's interoperability, and who's allowed in. In India, any UPI app can pay any UPI ID at any bank, and third-party apps like PhonePe and Google Pay were allowed to build on it from the start. Brazil did something similar: its central bank required large banks to offer Pix, so it was everywhere on day one. FedNow is voluntary; about 1,800 banks and credit unions had joined by 2026, but many can receive payments without yet being able to send them. A payment network is only as useful as the number of people you can reach with it, which is also why UPI now reaches abroad: since February 2023 it has been linked to Singapore's PayNow, so money can move between the two countries' fast-payment systems using a UPI ID on one side and a phone number on the other.

Where it breaks

Scale at this speed brings two problems a slower system never has to face.

Fraud built on speed. Brazil hit this first: after a wave of Pix-related crime, including people being forced to make transfers, its central bank in 2021 limited Pix transfers between individuals to R$1,000 at night. India's weak spot was the collect request, where someone else asks you to pay and you approve it. Scammers sent fake requests dressed up as refunds or prizes; people entered their PIN thinking they were receiving money. After years of trying caps, NPCI switched off person-to-person collect requests entirely from 1 October 2025. Merchant collect requests, like paying at an online checkout, still work, because the customer started that payment themselves.

Concentration. China shows where this can end up: two private apps, Alipay and WeChat Pay, handle the vast majority of its mobile payments. India is heading the same way. PhonePe and Google Pay together processed about 85% of UPI volume in late 2024. NPCI has set a 30% cap on any single app's share to stop it, but has pushed the deadline back twice; it now falls at the end of December 2026. A public road where two companies own almost every car is a policy question, not just a market one.

Why this matters for a Business Analyst

Think of a message that says "sent" before it says "delivered"

Every UPI flow has states between "started" and "done", and most production problems in payments live in those states, not in the happy path.

• Pending is a real state. A payment can debit you and then time out before the other bank confirms. A requirement that only says "the payment succeeds or fails" has skipped the case customers actually complain about. Acceptance criteria need to name what the user sees, and what the system does, while a payment is pending.
• Reversals have a legal clock, and India's is short. Under the RBI's 2019 turnaround-time framework, a failed UPI payment where money has left your account must be reversed by the next day (T+1); after that, the bank owes compensation of ₹100 a day. "Refund failed payments" is not a requirement. "Auto-reverse within T+1, and flag anything older for compensation" is.
• Three records must agree. The app, the bank and NPCI each keep their own record of every payment, and settlement happens in cycles later. A good design assumes those records already disagree and says how the mismatch gets found and fixed, not whether.
• Retries must not double-pay. If an app retries a request after a timeout, the system has to recognise it as the same payment, not a new one. Testers should try it on purpose.
• Limits are part of the spec. Most UPI payments are capped at ₹1 lakh each, with higher caps for specific categories such as tax, hospital and education payments. UPI Lite is a separate lane entirely: small payments of up to ₹1,000 from an on-device balance of up to ₹5,000, with no PIN. Every one of those numbers is a boundary a tester should hit exactly, and just over.
• Disputes have their own plumbing. The US gives banks a long, rule-bound window: under Regulation E, a bank generally has 10 business days to investigate a consumer's electronic-payment error. UPI routes complaints through NPCI's UDIR (Unified Dispute and Issue Resolution) system, raised from inside the payment app, and since November 2025 disputes even settle in their own separate cycles. A requirement should say which journey a complaint takes, not just that one "can be raised".

Lighthouse Insight

UPI's trick is that it separated two things most people assume are one: the promise that you've been paid and the money actually moving between banks. The promise travels in seconds, for free, to anyone. The money follows in a batch, a few hours later, between several hundred banks that trust the system enough to wait. Brazil and the US decided the money should move with the promise. India decided the promise was enough, and built the busiest payment system on Earth on that decision.

Reference anchors

• PIB: UPI completes 10 years, world's largest real-time payments platform
• Whalesbook: UPI hits record 23.66 billion transactions in July 2026
• Business Standard: UPI has around 49% share of global real-time payment volume (IMF)
• Business Standard: New UPI settlement rules from November 3, 2025
• PIB: Cabinet approves incentive scheme for low-value BHIM-UPI transactions
• MediaNama: NPCI to discontinue P2P collect requests from October 1, 2025
• Business Standard: NPCI extends market-share cap deadline to end-2026
• Wikipedia: Pix (payment system)
• Federal Reserve Financial Services: FedNow volume and value statistics
• NPCI: RuPay Credit Card on UPI FAQs
• ClearTax: UPI Lite limits
• World Bank: UK Faster Payments case study