OTP can’t secure payments: RBI rolls out stricter digital payment rules from April 1 – what is changing

Reserve Bank of India (File photo)

With the beginning of the new financial year, India’s digital payments landscape is poised for a major security overhaul as the Reserve Bank of India (RBI) rolls out stricter authentication norms from April 1.The move comes in response to rising transaction volumes and increasing fraud risks. RBI aims to strengthen the country’s payment ecosystem with more robust and adaptive safeguards.

What is changing in digital payments?

Under the updated rules, all digital transactions will now require two-factor authentication (2FA). This means that every transaction must incorporate at least one dynamic element such as a one-time password, biometric verification (fingerprint, face ID, etc.) or device-based authentication, according to ET. Previously, OTPs alone were sufficient, but experts have raised concerns over vulnerabilities to phishing and SIM-swap attacks.According to Sanjay Tripathy, CEO and Co-Founder of cross-border payments platform BRISKPE, “The RBI by mandating risk-based checks has formalised a framework that encourages a variety of authentication mechanisms beyond just SMS-based OTPs. The requirement for an Additional Factor of Authentication (AFA) in cross-border card-not-present transactions is a critical step to increase trust and reduce risks, benefiting both businesses and customers.” The RBI’s new framework signals a shift from rigid rule-based compliance to principle-driven regulation, promoting innovation while establishing a strong baseline for payment security.

Other banking and financial changes from April 1, 2026

Several banking and financial rules are set to change from April 1 affecting credit card users, FASTag holders, RuPay debit cardholders, PAN applicants and bank customers. SBI Card, for instance, has revised the redemption structure for its Cashback SBI Card, allowing statement credit redemption only in multiples of 4,000 reward points.The National Highways Authority of India (NHAI) has increased the annual FASTag pass fee from Rs 3,000 to Rs 3,075 for the financial year 2026–27.RuPay Platinum debit card holders will no longer be able to access airport lounges, both domestic and international, as well as train lounges, following a circular issued by the National Payments Corporation of India. PAN card applications will also face stricter requirements: from April 1 applicants will need to submit additional documents beyond Aadhaar and the name on the PAN will now exactly match the Aadhaar card, making it crucial for citizens to ensure their Aadhaar details are correct.HDFC Bank has announced several updates affecting lending rates, fixed deposit interest rates, ATM withdrawals and locker charges, while other banks including Punjab National Bank and Bandhan Bank are revising ATM withdrawal limits, fees and related rules.New income tax frameworkFrom April 1, the Income-tax Act, 1961, will be repealed and replaced by the New Income-tax Act, 2025. Certain transitional provisions have been included to ensure pending proceedings under the old Act continue without disruption, allowing for a smooth transition.

Why these changes matter

The RBI’s 2FA mandate is a significant step towards enhancing digital payment security, reducing fraud and aligning India with global best practices.The changes to PAN rules and the tax framework aim to streamline compliance while making citizens more accountable for accurate documentation. Meanwhile, banking changes, including modifications to credit card redemption, FASTag fees, and ATM access, will directly impact how customers manage their daily transactions. Collectively, these measures mark a substantial shift in India’s financial and digital payment ecosystem, laying the groundwork for a safer, more regulated and technologically aligned financial system.