RBI’s New 2FA Rules for Digital Payments (from April 2026) Explained
The Reserve Bank of India’s Authentication Mechanisms for Digital Payment Transactions Directions, 2025, issued on 25 September 2025, apply from 1 April 2026. They set out how banks and payment companies must verify that it’s really you making a payment. Here’s what changed, in plain language.
The key rules
- Two-factor authentication (2FA) remains required for domestic digital payments, unless a transaction type is specifically exempted.
- The two factors must come from different categories: something you know (PIN, password), something you have (your phone or a device-bound token) or something you are (fingerprint, face).
- For most transactions, at least one factor must be dynamic, meaning it’s unique to each transaction (such as an OTP or a cryptographic token).
- Payment providers can now use options beyond SMS OTP, such as app-based authentication, device binding, passkeys and biometrics. SMS OTP is still allowed.
- Providers can apply extra, risk-based checks on unusual or high-risk transactions.
What this means for you
- You may see more in-app approvals, fingerprint or face prompts, instead of SMS OTPs.
- Unusual transactions may need extra verification.
- Never share OTPs, PINs or approval prompts. Legitimate banks never ask for them.
If you’re a fraud victim
- Block your card / UPI immediately through your bank’s app or helpline.
- Report cyber fraud on 1930 or at cybercrime.gov.in.
- Inform your bank in writing as quickly as possible. RBI’s customer liability rules limit your loss if you report unauthorised transactions quickly.
Frequently asked questions
Is SMS OTP being banned?
No. SMS OTP remains a permitted factor. The directions simply allow, and encourage, other secure methods too.
Related guides
Official link: Reserve Bank of India. This is a simplified summary, not legal advice. Easy Guide India is not affiliated with RBI.