UPI ID Validator: Complete Guide to UPI ID Format, Handles, Security & Validation in 2026

The Magic Behind UPI IDs

UPI was launched by the National Payments Corporation of India (NPCI) in 2016. Before UPI, sending money to someone required knowing their bank account number, branch, and IFSC code — a cumbersome process prone to errors. UPI replaced all of this with a simple Virtual Payment Address.

A VPA (Virtual Payment Address) — commonly called a UPI ID — is essentially an alias for your bank account. When you create a UPI ID (through any UPI-enabled app), NPCI maps that ID to your bank account details in a secure vault. When someone sends money to your UPI ID, NPCI looks up the mapping, finds the target bank account, and initiates the transfer — all within seconds.

How the Routing Actually Works

1. Sender enters your UPI ID: priya.patel@okaxis
2. Their UPI app queries NPCI's mapper: "Where does this VPA resolve to?"
3. NPCI returns: "Axis Bank, Account ending in XXXX"
4. Sender confirms and authorizes with UPI PIN
5. NPCI initiates instant fund transfer via IMPS backbone
6. Receiver's bank credits the account
7. Both parties receive confirmation within 10–30 seconds

Why Validating the Format Matters

• Prevents money transfers to wrong or non-existent accounts
• Catches typos before the transaction is initiated
• Identifies fake/spoofed UPI IDs in scam attempts
• Ensures your UPI ID on invoices or payment requests is correct
• Helps developers validate input before hitting the UPI API

The Basic Structure

A UPI ID follows the format: username@handle

Where:

• username — the user-defined part before the '@'
• @ — mandatory separator
• handle — the PSP (Payment Service Provider) identifier after the '@'

Username Rules

Handle Rules

The handle (after the '@') must be a recognized NPCI-registered PSP handle. Common handles include 'okicici', 'okhdfcbank', 'paytm', 'ybl' (PhonePe via Yes Bank), 'ibl' (PhonePe via IndusInd Bank), etc.

Common UPI ID Formats by Type

• Phone-number based: 9876543210@paytm, 9876543210@airtel
• Name based: rahul.kumar@okicici, priya123@okhdfcbank
• Bank generated: 9876543210@sbi, accountnumber@pnb
• Custom business VPA: mybusiness@icici, shop.name@axisbank

The Authoritative UPI Handle Directory

Every UPI handle is registered with NPCI. Here is the comprehensive list of active UPI handles and the banks or PSPs they belong to, as of 2026:

How to Check if a Handle is Currently Active

The most reliable way to check if a handle is currently active is to attempt a small UPI payment (₹1) to an ID on that handle and see if the system returns a "Payment Successful" vs "Invalid VPA" response. Our validator checks handles against the known active list as of 2026.

Why Do These Apps Have Multiple Handles?

Google Pay, PhonePe, and Paytm are not banks — they are Payment Service Providers (PSPs). They need to route UPI transactions through a bank's UPI infrastructure. Each PSP has partnered with one or more banks to issue UPI handles. This is why Google Pay UPI IDs end in @okicici, @okhdfcbank, @okaxis, or @oksbi — depending on which bank's infrastructure was used when the UPI ID was created.

Google Pay (GPay) Handles

PhonePe Handles

Paytm Handles

Paytm is unique — it operates Paytm Payments Bank, which means it is its own banking PSP. So Paytm UPI IDs end in @paytm (Paytm Payments Bank). There is also the older @paytm handle for Paytm Wallet-based UPI IDs.

BHIM and Native Bank App Handles

BHIM (Bharat Interface for Money) — the government UPI app — issues VPAs with the @upi handle. Most native bank apps (SBI YONO, HDFC Bank app, ICICI iMobile) allow you to create UPI IDs with the bank's native handle: @sbi, @hdfcbank, @icici, etc. These native handles are generally considered more stable than PSP-issued handles.

The Short Answer: Yes, Sharing UPI ID is Safe

Your UPI ID (VPA) is designed to be shared. That's the entire point — it replaces the need to share your bank account number. When someone has your UPI ID, they can only send money to you. They cannot withdraw money, access your account, or see your bank balance. The UPI ID is not a credential — it is an address.

What Someone Can Do With Your UPI ID

• Send you money (payment request)
• See that the UPI ID is registered (a name check shows a partial name like "R*** S***")
• Send you a payment collection request (which you must approve)

What Someone CANNOT Do With Your UPI ID

• Withdraw money from your account
• Access your bank account details
• Debit your account without your UPI PIN
• See your account number or IFSC
• Reverse a payment you've already received

Real Scams That Use UPI IDs

While sharing your UPI ID is safe, scammers exploit user confusion in specific ways:

1. Fake payment screenshots: Scammer shows you a screenshot claiming payment was sent. You never actually receive the money — screenshot is edited.
2. QR code confusion: Scammer sends you a QR code saying "scan to receive money." Scanning and entering PIN actually makes a payment, not a receipt.
3. Collection request fraud: Scammer sends a UPI collection request (pay request) and verbally tells you to "approve the request to receive your refund." Approving means you SEND money, not receive it.
4. Look-alike UPI ID: Scammer creates a UPI ID very similar to yours or a trusted entity's to mislead payments.

Understanding UPI Transaction Limits

UPI has two types of limits: NPCI-set limits (applicable to all) and bank-specific limits (set by individual banks, often lower than NPCI's maximum). Here are the current limits as of 2026:

NPCI General Limits

Bank-Specific UPI Limits (2026)

Why Does the "Unknown Handle" Error Appear?

When you enter a UPI ID and the system (or our validator) says "Unknown Handle," it means the part after the '@' symbol is not recognized as an active, NPCI-registered PSP handle. This is one of the most common UPI errors and it has several causes:

Cause 1: Typo in the Handle

The most common cause. Examples:

• name@okicic (missing final 'i' from 'okicici')
• name@paytms (extra 's')
• name@phonepe (PhonePe doesn't have a @phonepe handle — it uses @ybl, @ibl, @axl)
• name@gpay (Google Pay doesn't use @gpay — it uses @okicici, @okhdfcbank, etc.)

Cause 2: Deactivated or Merged Bank Handle

When banks merge (e.g., Dena Bank into Bank of Baroda), the old UPI handles may be deactivated or redirected. If a customer gives you an old handle from a merged bank, you may get an Unknown Handle error.

Cause 3: Third-Party or Regional App Handle

There are hundreds of small fintech apps and regional co-operative bank apps registered with UPI. Their handles may not be in standard lists. These are valid but less common.

Cause 4: Test/Fake UPI ID

Someone gave you a UPI ID with a made-up handle — a common pattern in fraud attempts. Always cross-check any UPI ID handle against the known active list before sending money.