New Delhi, April 1 Two-factor authentication for all digital transactions, including the popular UPI platform, will become effective from Wednesday, in line with the RBI's directive as a measure to curb fraud.
Transactions will only be processed if the user completes both verification steps, meaning that even if someone sees your PIN, unauthorized payments will not be able to go through.
According to the Reserve Bank of India (RBI), all digital payment transactions in India are required to meet the norm of two-factor authentication. While no specific factor was mandated for authentication, the digital payments ecosystem has primarily adopted SMS-based one-time password (OTP) as the additional factor.
All payment system providers and payment system participants, including banks and non-bank entities, will ensure compliance with these directions by April 01, 2026, it had said.
The central bank introduced two-factor authentication (2FA) to reduce bank fraud and improve accountability.
From today onwards, users will not be able to make transactions simply by entering their UPI PIN, but will also have to verify the transaction by either entering a one-time password (OTP), fingerprint authentication, or facial recognition.
Besides, the user will not be able to take screenshots or screen recordings in the banking app, as it is completely banned to protect the user from any fraud.
The 2FA could lead to a few seconds' delay in the transaction, as one has to feed the other OTP.
In an ecosystem like UPI, where transactions settle in seconds, the only meaningful window to act is before the transaction is completed, Anil Tadimeti, Director, (Strategy & Regulatory Affairs), Bureau said.
"This is where authentication needs to evolve. Trust has to be established through context, by combining who you are, what you know, and what you have, and evaluating these signals in real time," he added.