RBI’s new rules for two-factor authentication of digital payments; Check alternative methods proposed

In order to allow the ecosystem to use different forms of authentication, the RBI has announced a draft on “Framework on Alternative Authentication Mechanisms for Digital Payment Transactions”.

The Reserve Bank of India has made securing digital payments a top priority, emphasizing the need for Additional Factor of Authentication (AFA) when making payments. Authentication did not require any particular criteria.

These 10 transactions will be reported as fraud to RBI, as per new rules


According to an RBI press release issued on July 31, 2024, “ the Reserve Bank of India has prioritised security of digital payments, in particular the requirement of Additional Factor of Authentication (AFA) for making payments. No specific factor was mandated for authentication, but the digital payments ecosystem has primarily adopted SMS-based OTP as AFA. While OTP is working satisfactorily, technological advancements have made available alternative authentication mechanisms.”

As per the draft, “Factor of Authentication: Any credential input by the customer which is verified for the purpose of confirming the originator of a payment instruction.
The factors of authentication are broadly categorised as below:

• Something the user knows (such as password, passphrase, PIN)
• Something the user has (such as card hardware or software token)
• Something the user is (such as fingerprint or any other form of biometrics).”

Unless otherwise specified in this framework, all digital payment transactions will be verified through the use of an additional factor of authentication (AFA). When determining the proper AFA for a transaction, issuers such as banks, non banks can use a risk-based methodology that takes into account the transaction value, origination channel, customer and/or beneficiary risk profiles, among other factors. Issuers must have a mechanism in place to notify customers of any eligible digital payment transactions almost instantly, as per the draft.

These are exempted from customer authentication:
Small value contactless card payments:
Small value card present transactions for values upto Rs 5000/- per transaction in contactless mode at Point of Sale (PoS) terminals.

E-mandates for recurring (other than the first) transactions:
Transactions in respect of:
a) subscription to mutual funds;
b) payment of insurance premium and
c) credit card bill payments, for values upto Rs 1,00,000, and in respect of all other categories, for values upto Rs 15,000/-.

Utility through select Prepaid Instruments / NETC:
The following categories of instruments/systems:
Prepaid Instruments (PPIs) issued under PPI – Mass Transit Service and Gift PPIs.
Transactions in the National Electronic Toll Collection (NETC) System

Small value digital payments in offline mode:
Offline payment transactions up to a value of Rs 500/-.