September 21, 2026·
post
I noticed something unusual in YES BANK's mobile banking app, and I'm trying to understand…
I noticed something unusual in YES BANK's mobile banking app, and I'm trying to understand the architecture behind it.
The mobile banking login PIN and UPI PIN appear to be coupled.
I tested this directly:
1. Changed the mobile banking PIN in the YES BANK app.
2. The UPI PIN changed along with it.
3. Changed the PIN again.
4. The new PIN was also the UPI PIN.
So these don't appear to be 2 independently managed credentials. Changing one changes the other.
That makes me ponder because National Payments Corporation Of India (NPCI) explicitly distinguishes between a bank-issued MPIN and the UPI PIN in its documentation.
NPCI describes the UPI PIN as the credential used to authorise UPI transactions, and specifically notes that the bank-issued MPIN is different from the UPI PIN.
Why does changing the YES BANK mobile banking PIN change the UPI PIN itself?
There may be a perfectly valid implementation or architectural reason for this. I'm not presuming that this is a security issue or an NPCI violation.
BUT, if the 2 credentials are actually backed by the same underlying credential, I'd be curious to understand
What mechanism or protocol causes a change to the mobile banking PIN to also change the UPI PIN?
Maybe someone familiar with UPI's bank-side architecture could enlighten us.
P.S. Sorry for the hackneyed LinkedIn-slop post opening. Yes, I think this post is not slop.
Have a thought or correction? Reach out on LinkedIn.
Get new notes by email
No noise — just new notes as they land.