Money basics · 7 min read ·

Track expenses from UPI and bank SMS, no typing

Every time you pay through UPI, your bank sends you a text message. "A/c XX3456 debited by Rs.240.00" — terse, automatic, and it never forgets. Most of us swipe these alerts away without a second look. But sitting in that inbox is something close to a complete record of your digital spending, built without any effort on your part.

Expense tracking apps have traditionally asked you to do the opposite: open an app after every purchase and type in what you spent. Almost nobody keeps that up past the second week. This article looks at the better path — reading the record your bank already sends you. What those SMS actually contain, how apps turn them into a categorised ledger, what granting SMS access really means for your privacy, and where the Account Aggregator framework fits in.

Why typing every expense fails

Manual expense tracking asks for a small effort at the worst possible moment. You have just paid the auto driver, the chai stall, the pharmacy — the last thing on your mind is opening an app and filling in a form. Skip one entry and the ledger is already wrong. Skip a day and the whole exercise starts to feel pointless.

UPI made this harder, not easier. When spending was cash, money left your pocket in a few large, memorable chunks. Now the same money leaves in twenty small taps — ₹40 here, ₹180 there — each one forgettable on its own. Reconstructing a month from memory is hopeless; by the time you sit down, "miscellaneous" has swallowed half your spending. The fix is not more discipline. It is using the record that already exists.

What a bank SMS actually contains

Transactional SMS in India are unusually structured, and that is by design. Under TRAI's DLT rules, commercial senders must register both their sender IDs — the headers like AX-HDFCBK-S or JD-SBIINB you see in place of a phone number — and the message templates themselves. Your bank cannot freestyle a debit alert; it fills in the blanks of a pre-approved template. That consistency is exactly what makes automatic parsing feasible.

A typical debit alert reads something like: "A/c XX3456 debited by Rs.1,240.00 on 12-Jul-26; trf to FRESH MART; UPI Ref 519876543210. Not you? Call 1800...". Unpack that and you have almost everything a ledger needs: the amount, the direction (debited or credited), the last digits of the account, the date, the counterparty — often a UPI VPA like shopname@okhdfcbank or a registered merchant name — and a reference number that identifies the transaction on NPCI's UPI rails.

What the SMS does not contain matters just as much. There is no category — nothing tells you FRESH MART is groceries. There is no item detail, and no note on whether it was a planned purchase or an impulse. And because both your bank and sometimes your UPI app notify you about the same payment, one transaction can arrive as two messages. Everything a tracking system does is about filling those gaps.

How parsing turns messages into a ledger

The pipeline has four steps. First, filtering: keep only messages from registered transactional sender IDs that match the shape of a debit or credit alert, and drop promotions, OTPs and everything else. Second, extraction: because DLT templates are consistent, rule-based parsing — patterns that pull out the amount, account digits, date, counterparty and reference number — works remarkably well. This part rarely needs machine learning at all.

Third, de-duplication: when your bank and your payment app both report the same ₹1,240, the reference number lets the system recognise them as one transaction, not two. Miss this step and every monthly total runs high.

Fourth — and hardest — categorisation. "trf to RAMESH KUMAR" tells you nothing about what was bought. Keyword rules get you partway: a food-delivery name means eating out, IRCTC means travel. But India's long tail of merchant names and personal VPAs defeats fixed rules quickly. This is where trained models earn their keep — classifying merchant strings and VPAs into categories, and improving as you correct them. A good system treats your corrections as its most valuable signal: recategorise that transfer to Ramesh Kumar as rent once, and every future payment to the same VPA lands in the right place.

What SMS permission really means

Here is the uncomfortable part. On Android, the SMS-reading permission is not scoped to bank messages. An app you grant it to can read your entire inbox — OTPs, personal conversations, appointment reminders, all of it. The operating system has no concept of "only transactional SMS". That is why Google restricts which apps may hold the permission at all, and why you should be deliberate about which app you trust with it.

India's Digital Personal Data Protection Act, 2023 gives that trust a legal shape. Consent under the DPDP Act must be free, specific, informed and withdrawable — a vague "we access SMS to improve your experience" does not meet that bar. A serious app should tell you plainly what it reads, what it ignores, where the parsing happens, and how to withdraw consent later. You also hold rights to correction and erasure of your data under the Act.

Architecture matters as much as the consent screen. On-device parsing means messages are processed on your phone and the raw text never leaves it — the stronger position. Server-side parsing means your SMS are transmitted and stored elsewhere, which raises harder questions about retention and access. A narrower model sits in between: apps that only parse messages you explicitly forward to them, so you control exactly which messages the app ever sees. Before granting anything, it is worth asking:

  • Is parsing done on the phone, on a server, or only on messages I choose to forward?
  • Is the raw SMS text stored anywhere, and for how long?
  • Can I delete my data, and is that deletion actually honoured end to end?
  • Is any of this data shared with or sold to third parties, including lenders?
  • Can I withdraw SMS consent without losing my whole account?

Account Aggregator: the cleaner pipe

There is a newer route that skips SMS entirely. The Account Aggregator (AA) framework, regulated by the RBI, lets you instruct your bank to share transaction data directly with an app — through a licensed intermediary, in structured digital form, under a consent that names its purpose and carries an expiry date. No SMS permission, no parsing of message text, and a consent you can review and revoke from one place.

AA is the cleaner design, and over time likely the default for serious financial apps in India. Its practical trade-offs today: coverage across banks is still growing, and statement data can arrive with a lag, whereas an SMS lands the second money moves. Many trackers will reasonably use both — SMS for immediacy, AA for the reliable history. A full explanation of AA deserves its own article.

A setup that actually sticks

However you automate, a few habits keep the ledger honest. Automation gets the data in; a few minutes of your attention each week makes it meaningful. The goal is not accounting perfection — it is that when you ask "where did ₹1,08,000 go since January?", the answer takes a minute, not an afternoon.

  • Pick one pipeline — SMS or Account Aggregator — as your source of truth. Running both carelessly doubles up transactions.
  • In the first month, check that alerts from all your banks' sender IDs are being picked up, and watch for duplicates.
  • Spend ten minutes a week correcting categories. Early corrections teach the system, and the effort shrinks quickly.
  • Give cash its own single bucket — ATM withdrawals recorded as one line beat a fiction of remembered detail.
  • Export a monthly summary somewhere you own, so your history is never locked inside any one app.

Questions people ask

Does an expense tracking app have to read all my SMS?
If it uses Android's SMS-reading permission, it technically can read everything — the permission is not limited to bank alerts. Alternatives exist: apps that parse only the messages you forward to them, and the Account Aggregator route, which involves no SMS access at all.
Will SMS-based tracking capture every expense?
No. Cash never appears, some wallet or small-value payments may not trigger an SMS, and card alert formats vary by bank. Treat it as covering most of your digital spending, and keep a simple cash bucket for the rest.
Is it legal for apps to read SMS in India?
Yes, with valid consent. Under the DPDP Act, 2023, that consent must be specific, informed and withdrawable, and you retain rights to correction and erasure of your data. An app that cannot clearly explain what it reads and why is not meeting that standard.
Should I use SMS parsing or Account Aggregator?
AA is the cleaner, regulator-designed pipe, with structured data and revocable consent; SMS is more immediate and works with nearly every bank today. Starting with one and moving toward AA as coverage improves is a reasonable path.

This is educational content, not financial advice.