A command line tool for UPI payment address discovery and reconnaissance.

pip install -r requirements.txt

You can use the following command to add an API key ID to the configuration file.

upi-recon.py <phone_number> --api_key_id <api_key_id>

Please refer to the documentation provided by Razorpay in order to generate valid API credentials.

Note: Razorpay does not seem to consider an API key ID as being sensitive information. Further, while the process of arbitrarily discovering the API key ID for a Razorpay merchant is fairly straightforward, it is beyond the scope of the repository and will thus not be covered. It is suggested that you generate your own Razorpay API credentials for use with upi-recon.

upi-recon.py -p <phone_number>

upi-recon.py -p <phone_number> -t 5

upi-recon.py -v <single_vpa>

upi-recon.py -g <gmail_username>

upi-recon.py -f <vehicle_number>

upi-recon.py -w <word>

Contributions are welcome. Feature wishlist:

• Introduce support for more API providers
• Introduce support for wordlist based address discovery
• Refactor for release as Python module
• Introduce support for FASTag addresses
• Introduce support for Google Pay addresses
• Improve argument parsing code

Note: Unified Payment Interface ("UPI") Virtual Payment Addresses ("VPAs") do not carry a data security classification by virtue of their usage in practice, and should as such be considered to be public information, similar to how email addresses may be considered to be public information.

This tool allows users to 1) check the existence of UPI payment addresses, and 2) fetch associated information about the account holder, in an automated manner based on provided input. This functionality is already available (however, not in an automated fashion) through most UPI payment applications available on the Android and/or iOS platforms.

This tool is provided "AS IS" without any warranty of any kind, either expressed, implied, or statutory, to the extent permitted by applicable law.