The Security and Safety of USSD Banking via *99#: Explained

Imagine you’re in a remote village, far from an internet connection, and you urgently need to check your bank balance or send money to a family member. Your smartphone might be out of reach, or perhaps you only have a basic feature phone. This common scenario highlights a significant challenge for many people relying on digital banking today.

Fortunately, there’s a powerful tool designed for these moments, ensuring you can manage essential banking tasks without needing data or even a smartphone app. This article will explain how USSD banking via *99# works, its strong security features, and what you can do to keep your transactions safe and private, regardless of your bank.

What Is USSD Banking via *99#?

USSD banking via *99# is a mobile banking service opened by the National Payments Corporation of India (NPCI) that allows you to perform financial transactions without an internet connection or smartphone app. This service operates on Unstructured Supplementary Service Data (USSD) technology, which facilitates communication between your mobile phone and your bank’s server.

To use it, you dial *99# from any mobile phone linked to your bank account, and an interactive menu appears. If you do not protect your Mobile PIN (MPIN), unauthorised individuals could open your account and perform transactions.

Should you suspect any fraudulent activity, you must immediately contact your bank’s official customer service channel or report it to the Cyber Crime Portal (2026) to mitigate potential losses.

What is USSD Banking and *99#?

USSD banking represents a crucial step towards financial inclusion in India, bridging the gap for millions who may not have open to smartphones or reliable internet. This service ensures that essential banking facilities remain accessible to everyone, regardless of their technological setup. It’s a testament to the country’s commitment to making digital payments widespread and convenient.

The *99# service, often called ‘UPI Lite’ for feature phones, allows you to perform basic banking functions directly from your phone’s dialler. It’s a simple, text-based interface that works across all telecom operators and most banks. You’ll find that while the core service is universal, specific menu options or bank-specific services might vary slightly depending on your financial institution.

Understanding USSD technology

USSD, or Unstructured Supplementary Service Data, is a communication protocol used by GSM cellular telephones to communicate with the service provider’s computers. Unlike SMS, which sends messages in a store-and-forward manner, USSD creates a real-time, session-based connection. This means that when you dial *99#, you’re interacting directly with your bank’s system in the moment.

This technology allows for interactive menu-driven services, making it perfect for banking where immediate responses are needed. The data sent over USSD is not stored on your phone or the network in the same way an SMS might be. This session-based nature contributes significantly to its security, as the connection is open only for the duration of your transaction.

The *99# service explained

The *99# service was opened by NPCI, the organisation behind UPI, to extend digital banking services to non-smartphone users and those in areas with limited internet connectivity. It’s often referred to as ‘National Unified USSD Platform’ (NUUP) and works across various banks. This service acts as a simplified gateway to your bank account, offering a range of essential functions without requiring any app installation.

You’ll find that the available services are designed to cover most immediate banking needs, making it a highly practical tool for daily use. While the core services are standardised, your specific bank might offer additional options or slightly different menu flows within the *99# interface. It’s always a good idea to familiarise yourself with your bank’s particular menu structure.

• Balance Enquiry: Instantly check your account balance.
• Mini Statement: View the last few transactions from your account.
• Fund Transfer: Send money to other bank accounts using their mobile number and MMID, or account number and IFSC.
• Change MPIN: Update your Mobile Banking Personal Identification Number for security.
• Aadhaar Seeding: Link your Aadhaar number to your bank account.

Who can use *99#?

The beauty of *99# lies in its universal accessibility. Any mobile phone user with a bank account linked to their mobile number can use this service, regardless of whether they own a smartphone or a basic feature phone. You don’t need to download any apps, making it incredibly convenient for a broad spectrum of the population.

To get started, you need to ensure your mobile number is registered with your bank account for mobile banking services. While most banks in India support *99#, the exact services and registration process might have minor variations from one bank to another. It’s always best to confirm with your specific bank if you encounter any issues.

How Does USSD Banking Work for You?

Using *99# banking is designed to be simple, mimicking the simplicity of dialling a phone number. Once you initiate the service, you’ll enter an interactive session where you can select various banking options by entering numerical codes. This process ensures that even those less familiar with digital interfaces can easily manage their finances.

The system is intuitive, guiding you through each step with clear prompts. This method helps you to conduct essential transactions quickly and efficiently, without the complexities sometimes associated with mobile banking apps or internet banking portals. You’ll find that the consistent interface across banks makes it easy to adapt, even if you switch financial institutions.

Dialling the *99# code

To begin your USSD banking journey, you open your phone’s dialler and enter *99#. After dialling, you’ll typically see a welcome screen or a menu from your bank. If you’re using the service for the first time with a particular bank, you might need to complete a one-time registration process, which usually involves entering your bank’s short name or the first few letters of its IFSC code.

Once registered, you’ll be prompted to set up your Mobile Banking Personal Identification Number (MPIN), which is crucial for authorising transactions. Remember that your bank will never ask for your MPIN over the phone or email. This initial setup might vary slightly across different banks, so pay close attention to the on-screen instructions specific to your financial institution.

Step 1: Open your phone’s dialler and type *99#, then press the call button.

Step 2: Select your bank from the list provided by entering the corresponding number, or enter the first four letters of your bank’s IFSC code.

Step 3: Enter the last six digits of your bank account number, followed by your bank’s IFSC code.

Step 4: Create your 4 or 6-digit MPIN and confirm it to complete the registration.

Step 5: You’ll receive a confirmation message, and your *99# service will be activated.

Simple menu navigation

After dialling *99# and selecting your bank, an interactive menu will appear on your screen, presenting a list of available services. Each service is assigned a number, and you manage by typing the corresponding number and pressing ‘send’ or ‘reply’. For example, you might type ‘1’ for balance enquiry or ‘2’ for mini statement.

The system is designed to guide you through each step, prompting you for necessary information like the recipient’s mobile number, amount, or your MPIN for transactions. This back-and-forth interaction continues until your request is completed or cancelled. You’ll find that the session expires after a short period of inactivity, which is a built-in security feature to protect your account.

Services available through *99#

The *99# platform offers a comprehensive suite of banking services, making it a strong alternative to internet or app-based banking for essential tasks. You can check your account balance, get a mini statement, and transfer funds using various methods. The range of services is continually updated, ensuring that you have open to the most common banking operations.

Beyond basic transactions, some banks also allow you to update your MPIN or even link your Aadhaar number through the *99# service. While the core offerings are consistent, some banks might provide unique additional services designed to their customer base. It’s always worth exploring the full menu offered by your specific bank to understand all available options.

Is USSD Banking Safe and Secure?

The security of your financial transactions is paramount, and USSD banking via *99# is built with multiple layers of protection to ensure your funds and data remain safe. The underlying technology and regulatory oversight work together to create a secure environment, even without an internet connection. You’ll find that the security protocols are comparable to those used in other forms of digital banking.

However, it’s important to remember that while the system is secure, your personal vigilance plays a critical role in maintaining that security. Understanding these protective measures helps you use the service with confidence. The Reserve Bank of India (RBI) and NPCI continually monitor and update these security standards, adapting to evolving cyber threats.

Encryption protecting your data

When you use *99#, the information exchanged between your phone and your bank’s server is encrypted. This means that your transaction details, including your MPIN and account numbers, are scrambled into an unreadable format during transmission. This encryption makes it extremely difficult for unauthorised parties to intercept and understand your data.

This end-to-end encryption ensures that your sensitive financial information is protected from potential eavesdropping. According to CERT-In (2026), strong encryption standards are a fundamental component of secure digital communication, and USSD banking adheres to these principles. You can rest assured that your data is handled with care throughout the transaction process.

Session-based security

One of the key security features of USSD banking is its session-based nature. Each time you dial *99#, a temporary, dedicated connection is established between your phone and your bank. This connection is active only for the duration of your transaction and automatically terminates after a short period of inactivity or once you complete your task.

This session-based approach minimises the window of opportunity for any potential security breaches. Unlike persistent connections, which might remain open, USSD ensures that your banking session is isolated and short-lived. This significantly reduces the risk of unauthorised open if your phone is left unattended after a transaction.

• Temporary Connection: Each *99# interaction creates a unique, short-lived session.
• Auto-Expiry: Sessions automatically time out after a few minutes of inactivity.
• No Stored Data: Transaction details are not stored on your phone after the session ends.
• Direct Communication: Data travels directly between your phone and the bank’s server.

PIN protection for transactions

Every financial transaction you initiate through *99# requires authentication using your Mobile Banking Personal Identification Number (MPIN). This MPIN acts as your digital signature, confirming that you are the authorised user making the transaction. Without your MPIN, no funds can be transferred, nor can sensitive account information be accessed.

Your MPIN is typically a 4 or 6-digit code that you set up during the initial registration process. It’s crucial to keep this PIN confidential and never share it with anyone, including bank employees. Different banks might have slightly varying rules regarding MPIN complexity or how often you are prompted to change it, but its core function as a security layer remains universal.

Regulatory oversight and standards

USSD banking, like all digital payment services in India, operates under the strict regulatory framework established by the Reserve Bank of India (RBI) and the National Payments Corporation of India (NPCI). These bodies set comprehensive guidelines for security, data privacy, and operational standards that all participating banks must adhere to. This ensures a consistent level of protection across the financial system.

The RBI regularly issues circulars and directives to enhance the security of digital transactions, including those conducted via USSD. For example, the daily transaction limit for *99# services is set as per the latest official guidelines, ensuring that even if a breach were to occur, the potential financial loss is contained. This regulatory environment provides a strong foundation of trust and accountability for users.

Your Role in Keeping USSD Transactions Safe

While USSD banking has strong built-in security features, your active participation is indispensable in protecting your financial information. Think of it as a partnership: the technology provides the framework, but your habits and vigilance complete the security chain. Being aware of best practices helps prevent common pitfalls and keeps your account secure.

Your bank will always provide guidelines on safe banking practices, and it’s essential to follow them diligently. Remember that no bank or official agency will ever ask you for your MPIN or other sensitive details over the phone or via unsolicited messages. Your proactive steps are the most effective defence against potential fraud.

Protecting your Mobile PIN

Your MPIN is the key to your USSD banking account, and protecting it is your primary responsibility. Never write down your MPIN or store it in an easily accessible place on your phone. It’s also advisable to change your MPIN periodically to enhance security, even if your bank doesn’t explicitly mandate it.

When entering your MPIN, always ensure you’re in a private setting where no one can observe your screen or keystrokes. If you suspect your MPIN has been compromised, you should change it immediately through the *99# service itself or by contacting your bank’s customer support. Different banks might have slightly different procedures for MPIN resets, so be familiar with your bank’s specific process.

Step 1: Dial *99# from your registered mobile number.

Step 2: manage through the menu to find the ‘Change MPIN’ option, usually assigned a specific number (e.g., ‘7’).

Step 3: Enter your current MPIN when prompted to verify your identity.

Step 4: Enter your new MPIN, ensuring it’s a strong, unique combination of digits that isn’t easily guessable.

Step 5: Re-enter your new MPIN to confirm it.

Step 6: You will receive a confirmation message indicating that your MPIN has been successfully changed.

Always checking transaction details

Before you finalise any transaction using *99#, take a moment to carefully review all the details displayed on your screen. This includes the recipient’s mobile number or account number, the amount being transferred, and the transaction type. A small error here can lead to funds being sent to the wrong person, which can be difficult to reverse.

Once you press ‘send’ or ‘reply’ after entering your MPIN, the transaction is usually irreversible. Therefore, double-checking these details is a crucial step in preventing accidental transfers and ensuring your money goes exactly where you intend it to. Always wait for the transaction confirmation message to ensure it was successful.

Being wary of suspicious calls

Cybercriminals often use social engineering tactics, such as phishing calls or SMS, to trick individuals into revealing their banking details or MPIN. They might impersonate bank officials, government representatives, or even family members, creating a sense of urgency or fear. Always be suspicious of unsolicited calls asking for sensitive information.

Remember that legitimate bank representatives will never ask you for your MPIN, ATM PIN, card expiry date, or CVV. If you receive such a call, disconnect immediately and report the number to your bank or the relevant authorities. The Ministry of Home Affairs maintains resources for reporting such cybercrimes.

• Unexpected Calls: Be cautious of calls claiming to be from your bank or a government agency that you didn’t initiate.
• Requests for PINs: Never share your MPIN, ATM PIN, or any other password with anyone, regardless of who they claim to be.
• Threats or Urgency: Scammers often create a sense of panic, threatening account blockage or legal action if you don’t comply.
• Offers for Rewards: Be wary of callers promising lottery winnings or large sums of money in exchange for your banking details.

Reporting any unusual activity

If you notice any suspicious transactions in your mini statement, receive unusual SMS alerts, or suspect your MPIN has been compromised, it’s vital to act quickly. Prompt reporting can significantly increase the chances of recovering lost funds and preventing further damage. Every minute counts when it comes to financial fraud.

You should immediately contact your bank’s official customer service helpline to report the incident and block your account if necessary. Additionally, you can file a complaint on the Cyber Crime Portal (2026). The portal provides a centralised platform for reporting cyber fraud, allowing authorities to investigate and take appropriate action.

Common Questions About *99# Security

It’s natural to have questions about the security of any banking service, especially one that operates without internet connectivity. Addressing these common concerns helps build confidence and ensures you use *99# banking effectively and safely. Understanding the answers to these questions helps you to take appropriate action if a situation arises.

Many of these questions revolve around scenarios involving lost phones or potential hacking attempts. The design of *99# banking, coupled with your personal security practices, provides strong answers to these concerns. You’ll find that the system is resilient, but your vigilance is the ultimate safeguard.

What if my phone is lost?

Losing your phone can be a worrying experience, especially when it’s linked to your bank account. However, USSD banking has safeguards in place.

Since transactions require your MPIN, an unauthorised person cannot open your account unless they also know your PIN. The session-based nature means no sensitive data is stored on your device.

Your immediate action should be to contact your mobile network provider to block your SIM card. This prevents anyone from using your number for *99# transactions.

Simultaneously, inform your bank about the lost phone so they can add an extra layer of security to your account. Different banks might have specific protocols for such situations, so be prepared to follow their instructions.

Step 1: Immediately contact your mobile network operator to block your SIM card.

Step 2: Inform your bank about the loss of your registered mobile phone and request them to disable *99# services for your account temporarily.

Step 3: Change your MPIN as soon as possible from another phone or through internet banking if available.

Step 4: Report the loss of your phone to the nearest police station and obtain a copy of the FIR (First Information Report).

Step 5: Once you get a new SIM with the same number, re-register for *99# services with your bank.

Can someone hack my account?

While no system is entirely impervious to sophisticated attacks, hacking your *99# account without your MPIN is extremely difficult. The encryption, session-based security, and the absolute requirement of your MPIN for any transaction form strong barriers. The primary vulnerability often lies with the user, not the system itself.

This means that as long as you keep your MPIN confidential and don’t fall for phishing attempts, your account remains well-protected. The system is designed to prevent brute-force attacks on your MPIN. The Reserve Bank of India (RBI) mandates strong authentication methods for all digital transactions, which *99# adheres to, making direct hacking without your MPIN highly improbable.

Are my details kept private?

Yes, your banking details and transaction history are kept private when you use *99# banking. The entire communication is encrypted, ensuring that your data remains confidential during transmission. Furthermore, banks are legally bound to protect your personal and financial information under strict data privacy regulations.

The session-based nature of USSD means that once your transaction is complete, no sensitive information is stored on your phone or the network. Your bank maintains records of your transactions, but this information is stored on their secure servers, accessible only through authorised channels. You can trust that your privacy is a top priority for financial institutions.

• Encrypted Communication: All data exchanged is scrambled to prevent unauthorised open.
• No Local Storage: No sensitive banking data is permanently stored on your mobile phone.
• Bank Data Protection: Banks follow strict RBI guidelines for safeguarding customer information.
• Session Isolation: Each transaction is an isolated session, reducing exposure risks.

The Benefits of Using *99# for Banking

Beyond its security features, *99# banking offers significant advantages that make it an invaluable tool for many individuals across India. Its core strengths lie in its ability to transcend connectivity limitations and its universal accessibility. These benefits contribute significantly to financial inclusion and convenience.

You’ll find that for quick, essential banking tasks, *99# often proves to be faster and more reliable than other digital methods, especially in challenging network conditions. It truly embodies the principle of ‘banking for all,’ ensuring that geographical or technological barriers don’t hinder open to financial services.

Banking without internet

One of the most compelling benefits of *99# banking is its independence from internet connectivity. This feature is particularly vital for people residing in rural areas, where internet open might be sporadic, expensive, or entirely unavailable. You can perform critical banking functions even with a basic cellular signal.

This capability ensures that you’re never cut off from your finances, whether you’re experiencing a network outage, travelling to a remote location, or don’t have a data plan. It provides a reliable fallback option for emergencies or when you need to make a quick transaction without relying on Wi-Fi or mobile data. This digital inclusion is a cornerstone of India’s financial strategy.

Accessibility for all phones

The universal compatibility of *99# with all types of mobile phones, from the simplest feature phones to the latest smartphones, is a major advantage. You don’t need a high-end device or specific operating system to open these banking services. This broad accessibility ensures that financial services are not limited to a select group of tech-savvy individuals.

This means that anyone with a working mobile phone and a registered bank account can participate in digital banking. You won’t need to worry about app updates, storage space, or complex interfaces. The simple text-based menu is easy to understand and manage for users of all technical proficiencies.

Quick and easy transactions

The design of *99# banking prioritises speed and simplicity. Once you’re familiar with the menu options, performing a transaction takes a few key presses. This makes it an incredibly efficient way to handle routine banking tasks, such as checking your balance before making a purchase or sending money to a vendor.

The instant nature of USSD communication means you receive immediate feedback on your requests, without the delays sometimes associated with SMS-based services. For instance, you can quickly check your balance or send money to a beneficiary in a matter of seconds.

This efficiency is particularly valuable when you’re on the go and need to complete a transaction without fuss. The transaction limit, as per the latest official guidelines, ensures that you can handle most daily financial needs quickly and securely.

Conclusion

USSD banking via *99# is an incredibly secure and accessible way to manage your finances, especially when internet connectivity is a challenge. By understanding its encryption, session-based security, and the critical role of your MPIN, you can use this service with confidence.

Always protect your MPIN and verify transaction details to ensure your funds remain safe. Setting up SMS transaction alerts, a feature offered by most banks, provides an immediate safety net, allowing you to promptly detect and report any unusual activity.