Digital payments eye sharper success rates as biometrics, passkeys replace OTPs

The digital payments industry is expecting a 2-3 percentage point jump in transaction success rates as new means of authentication such as biometrics and passkeys go live on payment networks.

One-time passwords (OTPs), the default second factor of authentication, have been prone to delivery issues, often leading to transaction failures, said industry executives.

Passkeys and biometric authentication, on the other hand, are tied to the device, so there’s no OTP delivery issue, thereby ensuring higher success rates.


“We expect biometric-based payment authentication to improve transaction rates,” said Girish Krishnan, director, payments rewards and merchant services at Amazon Pay.

He added that even for Unified Payments Interface (UPI) users inputting a wrong personal identification number (PIN) is very common, which can be addressed through biometric authentication.

Data from the National Payments Corporation of India (NPCI) shows that major banks operate at a success rate of 93-95% on UPI. Business declines are the major reasons for transaction failures, followed by technical declines.

Also Read: Experts welcome RBI’s digital payment authentication overhaul

Business declines are due to factors such as lack of funds and dormant accounts. Technical declines are usually due to entering the wrong PIN or some backend issues.

“The impact (of this move) will likely be most pronounced in card transactions, where a chunk of failures is because of friction points, which biometrics can effectively address,” said Bipin Preet Singh, CEO, Mobikwik.

While most of the large payment aggregators have launched biometric-based authentication, card companies like Visa are doubling down on passkeys as the second factor. It is a biometric system which generates a token for each consumer that is unique to the specific device and gets invoked every time there is a payment.

“With Visa Payment Passkey, every authentication is signed using a hardware-protected private key paired with a public key registered with Visa. This reduces dependency on telecom networks and renders phishing or credential replay attacks virtually impossible,” said Ramakrishnan Gopalan, vice president, head of products, India & South Asia, Visa.

In a credential replay, a cyber attacker intercepts authentication data and then uses it to gain unauthorised access to an account.

Additionally, passkeys can help economise the processing of digital payments, as the cost of sending OTPs will be drastically reduced, Gopalan added.

India processes billions of transactions every month, and there is a huge cost associated with sending the SMSes — that leg will be completely bypassed.

“Today, OTPs can be affected by factors like network issues, typing errors or code expiry — biometrics effectively removes those dependencies. The security layer also moves from ‘something you have’, such as an OTP, to ‘something you are’ (your biometrics), which makes it far more secure,” said Singh.

Also Read: ETtech Explainer: RBI’s digital payment authentication rules & their impact

Fraud prevention is another aspect that has enthused the payments industry.

While OTPs can be taken from unsuspecting customers through digital fraud, authentication using biometrics or passkeys is not prone to man-in-the-middle or phishing attacks, according to industry executives.

“With device tokenisation, which is already in place, it’s a much better user experience and also more secure since an OTP can be shared but this can’t,” said Reeju Datta, cofounder of Bengaluru-based payment aggregator Cashfree.

According to the August 2025 NPCI data for UPI, HDFC Bank had a 4.6% business decline rate, Bank of Baroda 8.5% and State Bank of India 5.9%. The highest was Airtel Payments Bank, 14.05%.

The Reserve Bank of India (RBI) issued the Digital Payment Transactions Authentication Directions, 2025, on September 26, outlining new principles for securing digital transactions. The guidelines mandate that all digital payments must be verified using at least two factors of authentication, unless exempted. These can include a password, PIN, SMS-based OTP, passphrase, hardware or software token or biometric methods such as fingerprint or Aadhaar-based verification.

The move comes as the RBI seeks to adopt more risk-based authentication models amid increasing instances of fraud in domestic and cross-border online payments.