Big change in UPI, card payments from April 1: RBI makes 2FA compulsory

New Delhi: From April 1, 2026, making digital payments in India is set to become more secure, but slightly more time-consuming, as the Reserve Bank of India (RBI) rolls out new rules for online transactions.

The central bank has made two-factor authentication (2FA) mandatory for all digital payments, including those made through UPI, debit and credit cards, and mobile wallets. This means that OTP alone will no longer be sufficient to complete a transaction. Users will now have to go through at least two layers of verification, such as a PIN, password, biometric authentication or token, along with OTP. The move comes amid rising cases of online fraud, including phishing and SIM swap scams, where OTP-based systems have proven vulnerable.

By adding an extra layer of security, the RBI aims to reduce the chances of unauthorised transactions and improve trust in digital payment systems. For users, the change means that payments may take slightly longer to complete, especially on new devices or for high-value transactions.

However, regular transactions on trusted devices are expected to remain relatively smooth.

The system will also adopt a risk-based approach, where the level of security checks will depend on the nature and behaviour of the transaction.

Another key aspect of the new rules is increased accountability for banks and payment platforms.

If a fraud occurs due to a failure in their systems, financial institutions may be required to compensate customers.