UPI doesn't just work based on phone number. Phone number is just the username equivalent in this context. You still need to put in a pin.