The directions, issued under the Authentication Mechanisms for Digital Payment Transactions, 2025, require every payment to be verified through at least two distinct factors — knowledge (PIN, password), possession (device token), or inherence (biometric). For card-not-present and online transactions, one factor will need to be dynamic and unique to each transaction, a move aimed at curbing fraud.

Unlike earlier blanket rules, the central bank has allowed issuers to adopt a risk-based approach. This means additional checks such as biometrics or contextual verification can be triggered for high-value or high-risk payments, while smaller, low-risk transactions can remain seamless.

The guidelines also bring cross-border, card-not-present transactions under their ambit from October 1, 2026. While SMS OTPs will continue, they cannot be the only layer of authentication. Exemptions have been carved out for small-value contactless payments, recurring transactions, NETC/Fastag, and offline digital modes.

Issuers will be responsible to safeguard customer interests and compensate for losses in cases of non-compliance. The directions also call for alignment with the Digital Personal Data Protection Act, 2023.

The post RBI Tightens Digital Payment Security; 2FA Mandatory from April 2026 appeared first on newsmantra.in l Latest news on Politics, World, Bollywood, Sports, Delhi, Jammu & Kashmir, Trending news | News Mantra.