RBI Authentication Rules: OTP Alternatives, Exempt Payments and the 1 October Overseas Card Check
RBI’s authentication rules start from one line: every digital payment in India must be confirmed by “at least two distinct factors of authentication”. What changed in 2026 is how that is done. Since 1 April, RBI’s Authentication Directions let banks offer factors other than the SMS OTP. From 1 October, card issuers must also check online card payments made to overseas merchants. If your bank app now asks for a fingerprint or an app PIN where it used to send an OTP, this is the reason.
RBI authentication rules in brief
The Reserve Bank of India (Authentication mechanisms for digital payment transactions) Directions, 2025, dated 25 September 2025, apply to “all domestic digital payment transactions, unless specifically exempted” (para 4) (RBI/2025-26/79).
| Principle | What RBI says | Para |
|---|---|---|
| Two factors | “at least two distinct factors of authentication”, unless exempt | 6(a) |
| One factor must be dynamic | For payments other than card-present ones, at least one factor must be “unique to that transaction”, such as an OTP | 6(b) |
| Independent factors | “compromise of one factor does not affect reliability of the other” | 6(c) |
| Choice | Issuers “may, at their discretion, offer a choice of authentication factors” | 6(a), note |
| Deadline | Compliance by 1 April 2026 | 3 |
What counts as a factor
Para 5 groups factors as “something the user has”, “something the user knows” or “something the user is”. It names password, SMS OTP, passphrase, PIN, card hardware, software token, fingerprint, or “any other form of biometrics (device native or Aadhaar based)”. In practice, the second factor can be your phone’s fingerprint sensor or an in-app token instead of an SMS. Which options you get depends on your bank.
Payments that are exempt
| Exempt use case (Annexure-1) | What it means for you |
|---|---|
| Small-value contactless card payments | Tap without a PIN, within the contactless limit |
| Recurring e-mandate debits after the first | Subscriptions renew within the e-mandate limits |
| Select prepaid instruments such as gift PPIs | Gift cards can be used without a second factor |
| NETC (FASTag) | Toll debits go through automatically |
| Small-value offline payments | Offline mode, within its caps |
| Corporate-card travel bookings | Applies to company cards only |
| Tap and Pay UPI on NFC terminals | Added by RBI’s letter to NPCI of 2 Sep 2026 |
The recurring-debit limits (₹15,000, or ₹1 lakh for insurance, mutual funds and card bills) are explained in our UPI limits guide and set out in RBI’s e-mandate framework.
The 1 October 2026 change for overseas card payments
Para 10 says card issuers “shall, by October 01, 2026, put in place a mechanism to validate non-recurring, cross-border card not present (CNP) transactions, where request for authentication is raised by an overseas merchant or overseas acquirer”. Issuers must also have “a risk-based mechanism for handling all cross-border CNP transactions”. If you pay a foreign website with an Indian card, expect your bank to ask for confirmation more often than before.
Card-present vs card-not-present
The directions draw a line between the two. A card-present transaction is one “carried out through the physical use of card at the point of transaction”: a swipe, dip or tap at a shop. A card-not-present transaction is one where “the card and acceptance infrastructure are not present in close proximity”, which covers online shopping, app payments and phone orders. The extra requirement in para 6(b), that one factor be dynamic, applies to everything except card-present payments. A static password plus your card number is therefore not enough online. Something unique to that transaction, such as an OTP or a cryptographic token from your device, has to be part of it.
Why your bank’s app may look different from your friend’s
RBI does not prescribe one method. Para 6(a) lets issuers offer a choice, and para 7 requires authentication or tokenisation services to be “accessible to all the applications / token requestors functioning in that operating environment”. In practice, two banks can roll out different options, such as biometric approval in one app and an OTP plus app PIN in another, and both can comply. If you want a non-SMS option, ask your bank which factors it offers on each channel.
Extra checks, and who pays when things go wrong
Para 8 lets issuers apply checks beyond the minimum two factors, based on location, device and your usual behaviour. It even suggests DigiLocker for confirming high-risk payments. An unusual large payment may therefore trigger an extra step.
Para 9 matters most if you lose money: “If any loss arises out of transactions effected without complying with these directions, the issuer shall compensate the customer for the loss in full without demur.” If a payment went through without the required authentication, quote this paragraph in your complaint. If you shared an OTP or PIN yourself, the separate customer-liability rules apply instead. For funds that are stuck, see debit holds on accounts, and for mistaken transfers, wrong account transfer recovery. If the bank doesn’t respond, escalate through the RBI Ombudsman.
If you get a prompt you didn’t expect
- You didn’t start a payment. Don’t approve it, and don’t read out any code. Call your bank on the number printed on your card or in its official app.
- You did start one, but the amount or merchant looks wrong. Cancel and start again from the merchant’s site. Check that the merchant name on the prompt matches.
- A foreign merchant you have never used. Since 1 October, your issuer must have a way to validate such payments. A prompt here is expected, but only if you placed the order.
Keep a screenshot of any prompt you rejected. It helps if you later have to show the bank that you didn’t authorise a payment.
Short answers to the questions readers ask most about the authentication rules.
FAQ
Has RBI banned SMS OTP?
No. The OTP is still a valid factor. Banks may now offer alternatives as well (para 6(a), note).
Why was I asked for a second check on a foreign website?
From 1 October 2026, issuers must validate non-recurring cross-border card-not-present payments when the overseas merchant requests it (para 10).
Who bears the loss if my bank skipped a required factor?
The issuer, “in full without demur” (para 9).
Does tapping my card need a PIN?
Not for small-value contactless payments, which are exempt under Annexure-1.
Takeaway: the authentication rules give banks room to offer more than an OTP. If your bank offers a device-based factor such as fingerprint or an app PIN, consider turning it on. And never share any factor, OTP or otherwise, with anyone who calls you.
Read in full
- RBI/2025-26/79, CO.DPSS.POLC.No. S 668/02-14-015/2025-2026, 25 Sep 2025: paras 3–10, Annexure-1
- RBI Digital Payments – E-mandate Framework, 2026, para 8 (limits)
Last verified: 10 Oct 2026, 8:00 AM IST. Checked: the Authentication Directions, 2025 (full text, including Annexure-1) and the E-mandate Framework, 2026 on rbi.org.in.
