₹ Dhuddu · Track your money on the go

Blog · Fintech · · 4 min read

RBI two-factor rules for digital payments: what changes for you

RBI now requires two checks for domestic digital payments, with one unique to each transaction. Here is what it means for your UPI and card payments.

By Dhuddu Team

Every time you pay online, your bank or app asks you to prove it is really you. A new set of RBI rules has changed how that proof works across India. If you have noticed a fingerprint prompt where an SMS code used to be, or wondered why a payment asked for one more check, this guide explains what is going on in plain language.

What the RBI directions say

In September 2025 the Reserve Bank of India issued the Authentication Mechanisms for Digital Payment Transactions Directions, 2025. Banks and payment companies were asked to comply by 1 April 2026, unless a specific provision has a different date.

The main points for everyday users:

  • At least two factors. Domestic digital payments need two different kinds of proof, such as something you know (a PIN), something you have (your phone) or something you are (a fingerprint or face), unless a payment is specifically exempted.
  • One factor must be dynamic. For most online payments, at least one factor has to be created fresh for that transaction, so a stolen password alone is not enough.
  • SMS OTP is not banned. Reports confirm the RBI did not order SMS codes to be discontinued. It simply opened the door to newer options such as device-based biometrics or app-generated tokens, if your bank or app chooses to offer them.
  • Extra checks for risky payments. Providers may look at things like your location, device and usual behaviour, and ask for more proof when something looks unusual.
  • Open access. Authentication and tokenisation services should work across apps and devices rather than being locked to one.

Cross-border card payments

Different rules apply to payments abroad. The two-factor rule does not apply to cross-border payments in the same way, but by 1 October 2026 card issuers needed a way to validate non-recurring cross-border online card payments when an overseas merchant asks for authentication, plus a risk-based check for such payments. If you buy from foreign websites with an Indian card, you may see an extra verification step.

What you may notice as a user

  • A fingerprint, face or in-app approval instead of a typed SMS code.
  • An occasional extra prompt for an unusual or large payment.
  • A declined payment when the check fails or times out, so keep your phone and network handy.

None of this changes what you owe, only how you prove it is you. It also does not make scams disappear: fraudsters now try to trick you into approving things yourself.

Protect yourself: a short checklist

  1. Never share an OTP or approve a prompt you did not start. Banks never ask for your UPI PIN or OTP to give you money.
  2. Check what you are approving. Read the amount and merchant name before you tap.
  3. Keep your phone updated and use a screen lock, since your phone is now a key factor.
  4. Turn on transaction alerts for every account and card so a surprise debit is spotted within minutes.
  5. Act fast on fraud. Report to your bank immediately, and file a complaint on the official national cyber crime reporting portal.

Why the rules matter now

UPI and card payments are now part of daily life, from rent and EMIs to groceries and recharges. More payments mean more chances for fraud, so regulators want a stronger and more flexible check on every transaction. For you, the useful habit is simple: treat every approval prompt as a decision, not a formality. If a prompt appears when you did not start a payment, deny it and tell your bank.

Practical takeaway

Security checks protect you only if you notice what they are protecting. Once a month, scan your statement for payments you do not recognise. Catching a small unknown debit early is far easier than disputing it months later.

This is general information, not financial advice.

How Dhuddu helps

Dhuddu reads your bank alerts through Gmail sync and lets you import statements, so every debit shows up in one list with its category. That makes an unfamiliar payment easy to spot. You can try it free at dhuddu.in or on Google Play.

Sources

More from the blog