UPI ID OSINT - Phone to UPI VPAs + Bank Names (India) MCP server

UPI ID OSINT - Phone to UPI VPAs + Bank Names (India)

Indian UPI OSINT - phone or VPA to active UPI IDs across all major apps plus bank-registered name from NPCI. BYOK Razorpay + PayU.

Available as an Apify Actor. Pay-per-event. BYOK pricing - upstream API costs go to your own Razorpay + PayU quotas, not through this actor.

What does it do?

Takes an Indian phone number or a custom UPI VPA and returns all active UPI IDs registered to that phone (across PhonePe, Paytm, BHIM, Google Pay, Amazon Pay, 30+ other UPI handles) plus the full bank-registered name from NPCI for each VPA. Bulk mode supported. BYOK Razorpay (for VPA enumeration) and PayU (for unmasked name resolution).

How is it different from manually trying 30+ UPI handles in different apps, or no alternative?

Production-tested end-to-end on real Indian phone numbers returning 7-9 active VPAs across multiple banks with full unmasked NPCI-registered names.

When should I use it?

• Indian fintech fraud investigation - validate a scammer's UPI footprint
• KYC enrichment - resolve VPA to bank-registered identity
• Law-enforcement OSINT for India (DPDP Act 2023 17(2)(a) law-enforcement exemption)
• Compliance screening for Indian fintechs
• Pre-transaction due diligence on a UPI counterparty

What does it cost?

Pay-per-event:

Typical scan costs

• Single phone -> all VPAs + names: $0.30
• Bulk 50 phones: $15

Which inputs does it take?

What does the output look like?

Each dataset record:

{
  "phone": "+91XXXXXXXXXX",
  "vpas": [
    {
      "vpa": "9999999999@ybl",
      "exists": true,
      "name": "ANSHUMAN ATREY",
      "bank": "AXIS BANK"
    },
    {
      "vpa": "9999999999@paytm",
      "exists": true,
      "name": "ANSHUMAN ATREY",
      "bank": "PAYTM PAYMENTS BANK"
    }
  ],
  "errors": []
}

Common questions

Q: Why BYOK? Razorpay and PayU rate-limit per merchant. BYOK means each investigator runs at their own quota with no shared throttle.

Q: Legal status? DPDP Act 2023 17(2)(a) provides law-enforcement exemption for legitimate investigation use. Compliance with applicable laws is the user's responsibility.

Q: Aadhaar / PAN / GSTIN lookup? Different APIs (Surepass / Karza). DM LinkedIn to request a sibling actor.

About the maintainer (priority response within 1-2 hours)

Built and maintained by Anshuman Atrey (@AnshumanAtrey).

Shortened. The full README is on GitHub.