RBI New Digital Payment Authentication Rules-Effective 2026

Background

• At the moment, the authentication of digital payment in India is supported by SMS-based OTP (One Time Password).
• The single-channel authentication has weaknesses , as demonstrated by the increasing frauds like SIM-swap attack, phishing attack, and OTP interception.
• RBI is focused on the global best practices and reinforcement of the dynamic digital payments environment in India.

Key Provisions (From April 2026)

• Most online transactions require minimum of Two Independent Authentication Factors .

• Exceptions:

  • Low-value payments (Rs20-Rs5,000 approx.).
  • Subscriptions (such as Netflix subscription).
  • Contactless/Offline tap and pay transactions.

Authentication Categories

• Something You Know - PINs, Passwords.
• Something You Have - Tokens that are based on devices, tokens that are generated in apps, hardware tokens, smart cards.
• Something You Are - Biometrics (fingerprint, face identification, iris scan).
• Banks/Payment Providers need to mix two or more categories .
• At least one of them should be dynamic and transaction-specific (e.g., OTP, cryptographic token).
• There can be more protection levels in case of transactions that are suspicious or highly valuable (unusual location, device or sudden increase in the amount).

International Transactions

• Non-recurring, cross-border, card-not-present transactions: Adding factor required as of October 1, 2026 .
• Recurring foreign payments were possible on risk-based authentication.

Accountability

• Failure by banks to adopt the framework by RBI will result in the reversal of liability between banks and customers in the event of fraud .

Implications

• Consumers : There will be more authentication options, fewer risks of fraud, and more confidence in international payments.
• Banks/FinTechs: Have to enhance infrastructure, spend more in compliance and get accountability and trust.
• Economy: Moves India to the same level with the rest of the world (e.g. PSD2 in Europe, FIDO authentication), invites innovations in digital security.