This is live today — April 1, 2026
If you've been using GPay, PhonePe, Paytm, or any UPI app, your payment experience changes today. The Reserve Bank of India's new mandatory two-factor authentication (2FA) rules for all digital payments are now in effect. OTP — the 6-digit code sent to your phone — is no longer enough by itself to complete a transaction.
This isn't a drill, it isn't a rumour, and it isn't coming "soon." It's live right now. Here's everything that's actually changing, written plainly.
What is two-factor authentication and why does it matter now?
Two-factor authentication means verifying your identity in two different ways before a transaction goes through. The old system often relied on just one thing: the OTP sent to your registered mobile number. That's a problem because OTPs are vulnerable to SIM swap attacks (where a fraudster gets a duplicate SIM of your number and intercepts the OTP) and phishing (where you're tricked into entering the OTP on a fake site).
RBI's new rules change this by requiring at least two verification factors from different categories:
Something you know: Your UPI PIN, banking password, or transaction password.
Something you have: Your registered device, a hardware token, or an authenticator app.
Something you are: Biometrics — fingerprint scan, face recognition.
Crucially, at least one of the two factors must be dynamic — meaning it's uniquely generated for that specific transaction and can't be reused. An OTP technically counts as dynamic, but it can't be the only factor. You need a second layer on top of it.
What specifically changes for UPI users?
For most regular UPI transactions on trusted devices — paying at a Swiggy order, splitting a bill, sending money to a contact — the day-to-day experience may not feel dramatically different immediately. Here's why: if you're using the same phone you've always used and your UPI PIN is your second factor, the system may recognise your device as trusted and apply the risk-based approach (more on that below).
Where you will notice a difference:
Logging in on a new device: If you install GPay or PhonePe on a new phone, the verification process will be stricter. Expect biometric confirmation or a device authentication step in addition to OTP.
High-value transactions: Transfers above certain thresholds will trigger additional verification. The exact threshold varies by bank and payment platform — most are setting it around ₹5,000-₹10,000 for extra checks.
Unusual behaviour: Transacting from an unusual location, at an unusual time, or with a payee you've never paid before may trigger an additional authentication step.
Card payments online: For debit and credit card transactions on e-commerce sites — Flipkart, Amazon India, Myntra — the OTP + PIN combination was already common. Now it's mandated for all platforms without exception.
The risk-based approach — what this means practically
The new framework isn't a blanket "always enter two things every time." RBI has implemented a risk-based authentication system, meaning the security checks scale with the assessed risk of a transaction.
Low risk (routine transaction on known device, small amount, familiar payee): May pass with standard verification, minimal friction.
Medium risk (slightly unusual pattern, moderate amount): OTP + PIN or biometric confirmation required.
High risk (new device, large amount, new payee, unusual location): Stricter verification — potentially OTP + biometric + confirmation delay.
Your bank and payment app will implement this scoring behind the scenes. You won't see the risk score, but you'll experience the difference in how many steps the payment takes.
What's exempted from the new rules?
Recurring e-mandates — your Netflix, Amazon Prime, Spotify, or any auto-debit subscription, your SIP mutual fund deduction, your loan EMI — are exempt. These will continue to auto-debit as before without triggering the new 2FA requirements.
Small value transactions below a certain threshold (typically ₹500 or under, depending on implementation) may also be treated with lighter verification under the risk-based approach.
Why is RBI doing this now?
India's digital payment fraud numbers have been climbing sharply. UPI fraud cases, SIM swap attacks, phishing scams targeting Indian bank customers — these have all increased as UPI adoption grew. The existing OTP-only system had well-known vulnerabilities that fraudsters had learned to exploit systematically.
The timing also connects to India's broader fintech ambitions. UPI is being positioned as an export — NPCI is actively expanding UPI to other countries. A payment system being positioned globally needs security standards that match global expectations, not just domestic minimums.
What banks and payment apps need to do — and what you need to do
Banks, payment platforms, and fintech apps were required to be compliant by April 1. If there are system failures or security gaps under the new framework, banks now face increased accountability — they may be required to compensate customers for fraud that occurs due to system-side failures rather than user error.
What you should do right now:
1. Make sure biometrics is enabled on your UPI apps. Go to GPay, PhonePe, or Paytm settings and enable fingerprint or face authentication if you haven't already. This becomes your most convenient second factor.
2. Keep your registered mobile number active and current. If your SIM is old, flagged for inactivity, or you've recently changed numbers without updating your bank — fix this today.
3. Don't use the same PIN for everything. UPI PIN, banking password — these should be different from each other and from your phone unlock PIN.
4. Update your banking apps. All major banks have pushed updates to comply with the new rules. If you're running an old version of your bank's app, update it immediately to ensure compatibility.
5. Don't panic about extra steps. Some transactions will take slightly longer. That's intentional. A 5-second extra verification step that prevents a ₹50,000 fraud is a very worthwhile trade.
TamilTech's take
This change is long overdue. OTP-only security was always a weak link — SIM swaps alone have defrauded thousands of Indians of lakhs of rupees. The new framework doesn't make payments harder, it makes fraud harder. Yes, occasional transactions will take a few extra seconds. That's the cost of protecting people's money in a country where digital payment fraud is a real and growing threat. Enable biometrics on your payment apps today. That's the single most practical thing you can do right now to be ready.
Comments (0)
Be the first to comment!