Comment by spikengineer

UPI primarily uses a virtual private address in the form of an email address.

You only need to disclose this vpa to the merchant.

It looks like username@statebank

You don't need to disclose your phone number or bank account number to the merchant if you don't want to as UPI has multiple address mechanisms.

You can also use QR