The RBI has taken a significant step to make digital payments secure. From April 1, 2026, two-factor authentication will be mandatory via options such as passwords, PINs, debit cards, fingerprints, or biometrics, in addition to SMS OTP. The objective is to protect people from online fraud and cybercrime.
Online Fraud: The Reserve Bank of India has announced changes to the digital payment system to curb online fraud. The new rules will come into effect from April 1, 2026, under which two-factor authentication will be mandatory via password, passphrase, PIN, debit card, software token, fingerprint, or biometrics, in addition to SMS OTP. The RBI states that this step will make online transactions more secure and convenient. Furthermore, in case of non-compliance with the rules, the customer will be responsible for any losses incurred.
When will the new rules come into effect?
The RBI has informed that the new rules for digital payments will be implemented from April 1, 2026. After this, two-factor authentication will be mandatory for all types of online transactions. Now, several other options will be added beyond just SMS OTP, which will allow for transaction verification.
New Options for Two-Factor Authentication
Until now, SMS OTP was considered the primary security measure for online transactions. However, several other options will now be available. The RBI has stated that passwords, passphrases, PINs, debit cards, software tokens, fingerprints, and biometrics can be used for two-factor authentication. This will give users the flexibility to choose a method according to their convenience.
Why Was This Step Taken?
Millions of digital transactions are conducted daily in India. From small shopkeepers to large businesses, everyone is accepting digital payments. However, cybercrimes have also rapidly increased alongside this. Often, people fall victim to fraud and lose their hard-earned money. It has frequently been observed that people hesitate to report to the police and quietly bear the losses.
The RBI believes that strengthening two-factor authentication will provide greater security to people and make it harder for cybercriminals to commit fraud.
Who Will Be Responsible for Losses?
The RBI has clarified that if customers do not comply with the new rules and incur any financial loss as a result, the responsibility will lie solely with the customer. This means adherence to the new rules will be mandatory when making online payments.
Increasing Reach of Digital Payments
Until a few years ago, the use of digital payments was limited to major cities. But now, people in villages and towns are also making payments via mobile. From vegetable vendors' carts to tea stalls, the option of online payment is available. This is why the number of digital transactions across the country has reached millions daily.
Rising Cybercrime Raises Concerns
Amidst the growing popularity of digital payments, cybercriminals have also started targeting people. Fraudsters are using methods like fake calls, malicious links, and digital arrests. Many individuals have fallen into their traps and lost years of earnings. In such cases, people often don't approach the police due to fear and quietly endure the losses.
Considering all these challenges, the RBI has decided to further strengthen two-factor authentication. Now, other options will also be used along with SMS OTP, to ensure transactions remain secure under all circumstances. The RBI has given clear instructions to banks and payment companies to implement these changes within the stipulated timeframe.
New System for Customers
Once the new rules are implemented, customers will not be limited to just OTP for digital payments. They will now be able to verify their identity using options like passwords, biometrics, or fingerprints. This will make transactions even more secure and curb fraud cases.
