RBI's new rule for foreign card payments: what to expect
Since 1 Oct 2026, banks must add extra checks on cross-border online card payments. Here is what changes for your foreign subscriptions and how to stay safe.
What changed on 1 October 2026
If you have ever paid for a foreign app, an overseas online course or an international hotel booking with your Indian card, a new RBI rule now applies to you. Under the Reserve Bank of India's Authentication Mechanisms for Digital Payment Transactions Directions, 2025, card issuers had until 1 October 2026 to put extra safeguards on cross-border card-not-present (CNP) payments. "Card-not-present" simply means you typed the card details online instead of tapping or swiping the card.
The wider rule is older. Banks and payment companies were required to follow the directions from 1 April 2026: every domestic digital payment needs at least two distinct authentication factors, and at least one of them must be dynamic, meaning unique to each transaction. Reports note that an SMS OTP alone is no longer treated as enough as the second factor in a risk-based setup.
What the October deadline asks issuers to do
According to summaries of the directions, by 1 October 2026 card issuers must:
- Put in place a way to validate non-recurring cross-border CNP transactions started by overseas merchants or their acquirers.
- Register their card BINs (the first digits of your card number) with the card networks, so that those networks can route authentication requests properly.
- Follow a risk-based framework for all cross-border CNP transactions, which means unusual payments can face extra checks.
Put simply, an overseas merchant that never asked for an OTP in the past can now be pulled into a verification step by your bank.
What it means for you
You do not need to do anything special, but you may notice a few things:
- An extra prompt or declined payment. A foreign subscription charged to an Indian card might ask for approval in your bank app, or fail if the check cannot be completed.
- Recurring foreign subscriptions behave differently. The directions target non-recurring overseas CNP payments. Recurring e-mandate transactions are among the listed exemptions, along with small-value contactless card payments, certain prepaid instruments, NETC (FASTag) payments, small-value offline digital payments and certain travel bookings.
- Better protection if something goes wrong. The directions say that if a loss arises from a transaction made without following these rules, the issuer must compensate the customer in full, without demur. That does not replace your own caution, and you should still report suspicious charges quickly.
Practical checklist
- Check your card's international usage setting. Most banks let you switch international and online transactions on or off in the app. Keep them off unless you need them.
- Keep your registered mobile number and bank app updated, so approval prompts reach you.
- Review foreign charges every week. Dollar subscriptions, app-store renewals and free trials are common leaks.
- Set a per-transaction or monthly limit on the card used for online payments.
- Never share an OTP or approval, even with someone claiming to be from your bank or a merchant. A genuine verification step never needs you to read the code out to another person.
- Report fast. If you spot an unauthorised charge, tell your bank immediately, note the complaint number and keep screenshots.
A quick example
Riya, a Bengaluru designer, pays about $15 a month for a design tool from her credit card. At roughly ₹84 per dollar, plus forex mark-up and GST, that is easily ₹1,350 or more each month, about ₹16,000 a year. When her bank adds a verification step, she gets a prompt, checks the amount and realises she also has an old, forgotten $9 subscription. Cancelling it saves her over ₹9,000 a year. The new check did not save her money by itself; looking at the list did.
Takeaway
The rule is mostly invisible when things are normal, but it is a good reason to audit your international spending. Expect a few more prompts, keep your phone and bank app handy, and treat any unexpected approval request as a signal to stop and check.
This is general information, not financial advice.
How Dhuddu can help
Foreign subscriptions and card charges are easy to lose track of. Dhuddu can read your Indian bank alerts and statements, so card spends and recurring payments land in one place and you can spot a stray charge before it repeats. It is free, and the Android app is on Google Play.