UPI requires a one time password sent to your phone to work (via an app or text message, app being obviously more secure). Now, if you lose both your phone and your card, you would need to apply for a new card - hopefully your phone is password protected.