BHIM

Is BHIM safe?

Yes, BHIM is one of the safer ways to make UPI payments in India. It comes from the organisation that runs UPI itself, it has no ads and no loan offers, and we found no breach of the app and no fine. Like every UPI app, it cannot protect you from being talked into sending money, and its App Store privacy label is not accurate. We score it 66/100, above Google Pay (62) and PhonePe (59).

BHIM, short for Bharat Interface for Money, launched in 2016 and has more than 100 million installs on Google Play. Since 2024 it has been run by NPCI BHIM Services Limited, a wholly owned subsidiary of the National Payments Corporation of India (NPCI), set up after RBI approval in May 2024. That makes it the reference UPI app rather than a commercial product built to sell you something.

What data does BHIM collect?

Less than most payment apps, but not nothing, and not what Apple's label says. The App Store listing shows "Data Not Collected". The privacy policy lists your phone number, the last six digits of your Aadhaar number, bank account and transaction details, device identifiers, SIM details, IP address and location data. It reads your contacts if you allow it, to find people to pay, and says it does not store them. Google Play's data safety form is closer to the policy: it lists phone number, payment information, purchase history, app activity and device IDs, and says the phone number is shared for app functionality, analytics and fraud prevention.

What matters most is what is missing. Neither Google Play nor the policy mentions advertising use of your data, and the app has no lending marketplace that passes your details to lenders. The policy does allow BHIM to "send and allow third parties to send offers and promotional materials" and to run third-party analytics, which it says excludes personally identifiable and payment data. Data is stored on NPCI premises in India.

We score privacy on the policy, not the label, because the label clearly understates it.

How secure is BHIM?

Every payment needs your UPI PIN, set with your own bank, and the money stays in your bank account until you pay. The privacy policy says NPCI BHIM Services holds ISO 27001, ISO 27701 and PCI DSS certifications and a SOC 2 Type II report, uses encryption and data-leak prevention, and runs automated fraud checks on transactions that can decline a payment and report it to banks.

BHIM's one security scare was not about the app. In 2020 vpnMentor found 409 GB of data, about 7.26 million records with ID scans and caste certificates, in an unprotected Amazon cloud bucket labelled csc-bhim. CloudSEK's analysis showed it belonged to a site run by CSC e-Governance Services to onboard small businesses and farmers onto BHIM, and NPCI said the BHIM app was not compromised. We found no public bug bounty for BHIM or NPCI.

UPI scams on BHIM

BHIM users face the same tricks as everyone else. India recorded 12.64 lakh UPI fraud incidents worth ₹981 crore in 2024-25 across all apps, and ₹805 crore in the first eight months of 2025-26, the Finance Ministry told the Lok Sabha. NPCI barred person-to-person collect requests from 1 October 2025, ending the classic fake-buyer request, but QR "refunds", fake customer-care numbers and screen-sharing apps still work on people.

Two newer features change who can pay from your account. UPI Circle lets someone you trust, such as a parent or child, make payments from your bank account without having one of their own. Family Mode manages payments across a household. Both are useful, but check exactly what each person may spend and review it. UPI Lite allows PIN-less payments of up to ₹1,000 each from an on-device balance of up to ₹5,000, the limits the RBI set in December 2024, so keep a strong phone lock.

How to use BHIM safely

1. Never enter your UPI PIN to receive money, and never share it or an OTP.
2. Download BHIM only from the App Store or Google Play; the publisher must be NPCI.
3. Add only people you fully trust to UPI Circle, and remove them when you no longer need to pay for them.
4. Keep a strong screen lock if you use UPI Lite.
5. Get help only through the app or bhimupi.org.in, not numbers found by web search.
6. Report fraud at once on 1930 and to your bank.

How we scored it

Regulatory record (88) and security (72) are BHIM's strongest factors: a clean record, PIN-based payments and published certifications, with no regulator review of the app itself and no bug bounty. Scams (50) is the weakest, since UPI fraud hits every app. Privacy (66) is the best of the Indian payment apps we have scored, held back by a label that says nothing is collected when the policy says otherwise.