From my understanding, I think just your phone number/VPA is enough to send money. I am not sure how it works in practice but I assume the VPA concept is there so that your phone number is not exposed if you don't wish to.
This only works if both parties are on the same PSP and no VPA lookup over UPI is required. So if I am not registered on PhonePe, you can’t send me money using just my phone number there.
For other cases, most PSPs will automatically register mobile@psp for you with an opt-out.
