The Unified Payments Interface (UPI), India’s flagship real-time digital payments system, has suffered four service disruptions in less than a month. The most recent, on April 12, lasted for nearly five hours—the longest system downtime in over three years. Investigations into the cause have revealed a critical flaw in how banks interact with UPI infrastructure, prompting the National Payments Corporation of India (NPCI) to push for immediate corrective action.
At the core of the problem is the unchecked volume of API (Application Programming Interface) calls—specifically, those used to check transaction status. Banks, in a bid to confirm whether money had been successfully debited and credited, were repeatedly pinging the UPI system with status requests.
While NPCI guidelines allow a maximum of three such calls per transaction, spaced 90 seconds apart, these limits were not being enforced. The result was a flood of redundant API traffic that overwhelmed the system and triggered a cascading failure.
NPCI, which operates UPI, had not implemented a central rate limiter to block these excessive requests. Instead, enforcement of the rule was left to individual banks.
ALSO READ: Call for Cyber Experts: Join FCRF Academy as Trainers and Course Creators
A banker familiar with the issue admitted that all major payment service provider (PSP) banks were involved in the overuse of these API calls, violating the protocol. “None of them adhered to the rule,” the banker said. “This was a wake-up call for everyone.”
The April 12 outage has spurred emergency meetings between NPCI and leading PSP banks, including HDFC, SBI, ICICI, and Axis Bank. One of the key proposals discussed involves setting hard limits on the number of API calls per transaction. Another proposal suggests that NPCI could begin blocking systems that abuse the network’s architecture. The stakeholders may meet again to review and implement a formal monitoring mechanism.
A typical UPI transaction involves up to 10 digital handshakes across multiple entities: the payer’s and payee’s PSPs, remitter and beneficiary banks, and NPCI itself. If any server in this complex chain experiences downtime or delays, banks often resend transaction status requests to verify outcomes. This retry logic, while well-intentioned, backfired on April 12 when too many simultaneous requests flooded the system.
The situation worsened because UPI was built for real-time processing, unlike card transactions that settle in batches. With more than 550 million UPI transactions per day and over 83 percent of all digital transactions in India flowing through the platform, the pressure on system stability is immense. Most of these transactions are micro-payments below Rs 500, putting further strain on banks’ core systems not designed to handle such volumes in real time.
NPCI has advised banks to refer to the raw data files it provides every two hours, which contain the confirmed status of transactions. These files, NPCI said, should serve as the “source of truth” instead of bombarding the system with repeated API calls.
However, bankers argue that the report does not clearly explain the origin of the issue. According to them, increased API traffic is usually a reaction to an already failing system, not the starting point of the problem.
The April 12 incident follows three other recent outages on March 26, March 31, and April 2. On March 26, a hardware issue and network instability impacted transactions nationwide. The April 2 disruption stemmed from the outage of a key remitter-side UPI app. On April 11, banks reportedly experienced high loads due to financial year-end processing, though NPCI claimed the UPI system itself remained stable.
ALSO READ: “DFIR Capability Maturity Assessment Framework” by ALGORITHA
Despite these issues, UPI continues to grow at a record pace. In March 2025, the platform processed Rs 24.77 trillion in value across 19.78 billion transactions—surpassing Rs 24 trillion in value and 19 billion in volume for the first time. For the full financial year 2024–25, UPI handled Rs 260.56 trillion in transactions, a 30 percent jump from the previous year. The volume of transactions rose 42 percent to 131.14 billion from 92.48 billion in FY24.
Still, the recent outages cast a shadow over this success story. The Reserve Bank of India and the central government are closely monitoring the situation. A permanent fix is now seen as urgent—not just to protect UPI’s credibility but also to ensure uninterrupted access to digital payments for over 400 million users across India.