EXPLORABLE Nº 01 · PAYMENTS

Two Seconds

You tap Pay. A chai-wallah's phone buzzes. This is the story of everything that happens in between — slowed down until you can watch it work.

interactive · ~10 min · grows out of How UPI Actually Works

The tap

There's a chai stall you like. The chai is ₹20 and excellent; the QR code is laminated and slightly sun-bleached. You scan it, type the amount, press your thumb to the sensor.

two seconds, start to finish

That's the entire experience. Two seconds, one green checkmark, one buzz from the chai-wallah's pocket. It's so smooth it's practically invisible — which is precisely the problem.

Because in those two seconds, your payment crossed at least six systems, was validated by three separate entities, and left a data trail that five different parties now keep. You just set off one of the 100 billion transactions UPI carries in a year, and you saw none of it.

So let's run it again. This time about a thousand times slower — and this time, we follow the twenty.

Meet your twenty

This is your ₹20. It lives in your bank account — a detail that will matter enormously later — it is in an excellent mood, and for the next two seconds it is the protagonist of Indian payments infrastructure.

(You may have noticed its edges are drawn in dashes, as if it isn't entirely… solid. Sharp eyes. Hold that thought.)

Every payment is a small play, and the story is clearer once you've met the cast. Here is everyone your twenty is about to encounter:

  • Your Phone

    the origin

    Reads the QR, checks your PIN or fingerprint — locally. Nothing leaves the device until you approve.

    keeps: your PIN (it stays here)

  • PhonePe

    the translator (PSP)

    Doesn’t hold money. Doesn’t move money. Converts your tap into a standard UPI message and passes it on.

    keeps: device, location, habits

  • NPCI

    the switch

    The exchange every UPI payment in India routes through. Resolves addresses, connects banks, confirms both sides.

    keeps: both sides of everything

  • Your Bank

    the vault

    Where the ₹20 actually lives — and the only one who can debit you, after checking balance and limits.

    keeps: balance, income, outflow

  • Recipient's Bank

    the landing

    Receives the credit instruction from NPCI and adds ₹20 to the chai-wallah’s account.

    keeps: credit + reference no.

  • Chai-wallah's Phone

    the destination

    Whichever UPI app he uses. It gets the good news and buzzes.

    keeps: sender VPA, amount, time

THE JOURNEY · LIVE MAP ALL SEVEN HOPS t ≈ 0 ms

Here's the whole map. Six stations — and NPCI, the switch every UPI payment in India passes through, sitting at the top like a telephone exchange. Your twenty starts bottom-left, on your phone.

The clock in the corner counts transaction time. (It's illustrative — real hops vary with network weather. Only the two-second total is the documented experience.) Scroll on. We're off.

t ≈ 120 ms — You → PhonePe The PIN check already happened on your phone; nothing left the device until you approved. Then your app fired an encrypted request to PhonePe's servers: user X wants to send ₹20 to chaiking@ybl.

And there it is — the first purple. PhonePe now holds your device model, your GPS location, the amount, the recipient, the time. The twenty has barely left home and it's already being written down.

t ≈ 340 ms — PhonePe → NPCI Here's the thing about PhonePe: it doesn't process payments. It translates. Your tap becomes a standard UPI message — a specific XML structure every participant in the ecosystem understands — and gets handed to NPCI.

Think of PhonePe as the counter clerk of a dabbawala network: it packages the lunchbox, labels it correctly, and passes it into the chain. The clerk never delivers anything.

t ≈ 520 ms — NPCI → your bank First, NPCI answers a question: who is chaiking@ybl? A VPA is a human-readable alias; NPCI resolves it to a real bank account, the way DNS resolves a website's name. Then it turns to your bank with a polite demand: debit ₹20 from the account behind user X.

t ≈ 780 ms — Your bank ✓ → NPCI Your bank runs the checks. Balance sufficient? Daily limit fine? Then — and your twenty finds this part deeply unsettling — it places a hold. The ₹20 is set aside: reserved, not yet gone. Debit authorised, says the bank.

All of that took milliseconds. Your bank's systems process thousands of these every second.

t ≈ 980 ms — NPCI → their bank Now NPCI pivots to the other side of the map: credit ₹20 to the account behind chaiking@ybl. Notice the pattern — NPCI talks to both banks but never holds the money itself. Messenger, coordinator. A powerful one.

t ≈ 1,240 ms — Their bank ✓ → NPCI The chai-wallah's bank adds ₹20 to his account and confirms: credit completed. Two banks that have never spoken to each other just settled a transaction — because they didn't need to. That is the entire point of a central switch.

t ≈ 1,450 ms — The cascade NPCI fires confirmations both ways at once: your app draws its green checkmark; the chai-wallah's phone buzzes. Seven hops. Three validations. One switch in the middle of everything.

t ≈ 1.9 s — Arrival Your twenty takes a bow. But before you go — look back at the map. Every station it touched kept something. Purple, everywhere.

And one more thing, which we'll deal with shortly: your twenty is lying to you about the trip it just took.

The data shadow

Follow the money and you only get half the story. Run the journey back in your head — but this time forget the ₹20 and look at what stayed behind. Every station kept a copy of its moment with your twenty. Not out of malice; it's simply what computers do. They remember.

Five separate entities now hold a record of your chai. Try each chair on for size:

What PhonePe saw

witnessed: hops 1 · 2 · 7
  • your identity
  • device model + OS version
  • location (GPS)
  • time
  • amount: ₹20
  • recipient VPA: chaiking@ybl
  • transaction ID

Over time: your complete spending patterns, favourite merchants, time-of-day habits, geographic movement. One chai is a data point. A year of chai is a portrait.

What NPCI saw

witnessed: every hop — it routed them all
  • both parties’ identities
  • amount: ₹20
  • timestamp
  • both banks
  • both PSPs
  • VPA resolution: chaiking@ybl → account
  • status: SUCCESS

NPCI sees every UPI transaction in India — over 100 billion a year. Each one is a line connecting two people, two banks, an amount, and a moment. That’s a graph of the country’s economic activity at a resolution nobody has ever had before.

What your bank saw

witnessed: hops 3 · 4
  • balance before and after
  • debit: ₹20
  • NPCI reference number
  • timestamp

Over time: your income, your outflow, your balance trends. Your bank has always known this — UPI just raised the resolution from monthly statements to every single chai.

What your ISP saw

witnessed: only the wire — and that was enough
  • your device ↔ PhonePe’s servers
  • this morning, 8:47 AM
  • packet sizes and timing
  • contents: ✕ encrypted (TLS)

Your ISP can’t read a single byte of the payment. But the pattern of connections reveals the transaction anyway: it knows you used a payment app at 8:47 AM — and if it sees the same pattern every morning, it can infer your habits without ever breaking the encryption.

The payment was instant; the records are permanent. And notice what the last chair teaches: nobody had to read your encrypted packets. Nobody needed to. The pattern of connections told the story on its own.

The twist: nothing moved

Now. About those dashes.

When NPCI said success — when the checkmark went green, when the chai-wallah's phone buzzed — no money had moved between the two banks. None. What you watched cross India wasn't your ₹20. It was a promise with your name on it: your bank committed to pay, his bank committed to credit.

THE TRIP YOU WATCHED

YOU THEM

a twenty, hopping across India in two seconds — edges drawn in dashes

WHAT ACTUALLY MOVED

YOU THEM

your actual ₹20 — in your bank's vault, the whole time.
what travelled was an instruction: a promise, wearing its face.

The real movement happens hours later, in batches. NPCI tallies up everything the banks owe each other across thousands of payments, works out the net, and instructs the Reserve Bank of India to move the difference. Watch what that does to an afternoon:

THE SETTLEMENT LEDGER · AN ILLUSTRATIVE AFTERNOON 10 payments · ₹4,150 promised
  • someone's chai (yours) ₹20
  • a tailoring bill ₹500
  • an auto fare ₹75
  • a mobile recharge ₹90
  • groceries ₹450
  • a saree ₹850
  • school fees ₹1,200
  • someone else's chai ₹45
  • a plate of samosas ₹300
  • an electrician's bill ₹620
A → B: ₹2,045 A ← B: ₹2,105

NET & SETTLE → Bank B pays Bank A ₹60

one transfer, through accounts at the Reserve Bank of India — that's the only money that actually moves

Ten payments. Thousands of rupees promised back and forth. One small transfer at the end. This is how "instant" can also be efficient: promises are cheap, and the accounting is batched. Your twenty was promised in two seconds and settled hours later. (It never found out. Kindly don't tell it.)

The switch that sees everything

One more zoom-out before the encore. Your chai was one of the 100 billion transactions UPI carried in 2023 — street vendors and multinationals, ₹20 chai and ₹20 lakh cars, all on the same rails. And every single one of them crossed the same point on the map.

THE SWITCH · EVERY PAYMENT IN THE COUNTRY ≈ 3,200 every second

Every arc is somebody's payment; all of them go through the middle. (The counter assumes 2023's 100 billion spread evenly — chai is not evenly distributed, but you get the idea.)

This is a deliberate design, and it's why UPI works at all: because everything routes through NPCI, any two banks can transact without ever having met. But centralisation is a package deal, and it comes with three properties worth saying out loud:

One point of visibility. NPCI can see all of India's digital payment activity — a graph of the country's economic life at a resolution no entity has ever had before.

One point of failure. You just flicked that switch yourself. When NPCI has an outage, payments stop for the whole country at once.

One point of control. NPCI sets the rules, the limits, and decides who gets to participate.

None of this is a scandal. It's a trade — and you're one of the parties to it, every time you tap Pay. Where all that data lives, and who gets to look at it, is a story of its own: Data Localisation in India.

Once more, with feeling

You've seen it slow. You've met the cast, read their ledgers, opened the vault, flicked the switch. Here is the same button you pressed at the top of this page — but you are not the same reader who pressed it.

Watch closely. It's all there, in the blink.

ONE MORE TIME · AT FULL SPEED t = 0 ms

same button. new eyes.

Where to next

EXPLORABLE Nº 01 · MADE AT THE WORKSHOP OF SOLITARY FUNC

SEARCH