[sudeepj]

> Are they taking necessary steps to mitigate ddos

I am not sure how this would happen in this case. If you want to flood the system you will have initiate a lot of payments which will be costly.

Both sender and receiver are authenticated with bank, so there is a traceability.

Also, you need a bank license from the central bank to act as a bank and each UPI is linked to an bank account which itself is linked to details. To add, it is now difficult (not impossible) to have anonymous bank account because they are linked to a central ID called Aaddhar number [1] and other KYC procedures.

One will have to really execute an elaborate scam like in Ocean's 11 movie to make this work.

[1] https://en.wikipedia.org/wiki/Aadhaar