RBI makes 2FA mandatory from 1 April, 2026

• Manish Kumar
• 24 Mar 2026
• 188 Views

From 1 April 2026 onwards, the digital payments ecosystem in India will undergo a major change. From this date, the Reserve Bank of India will mandate two factor authentication (2FA) for all digital transactions that take place in the country. To put it in a simple way, the RBI has mandated that every digital payment transaction must undergo an authentication using at least two different factors. 

These factors can be passwords/passphrases, PINs, SMS based OTPs, hardware tokens or cards, software authentication tokens and biometrics like fingerprints or facial recognition. At least one factor of the two factors must be dynamic in nature. It must be generated uniquely for each and every transaction. 

Banks and fintech companies can offer their customers different authentication options as long as they follow all the rules. The guidelines make 2FA mandatory for all the payments, allow extra checks based on risk and hold issuers responsible in case of fraud occurred due to non-compliance. 

Why has RBI tightened the rules?

Over the past decade, India has witnessed a major growth in digital payments because of UPI, mobile wallets and fintech innovation. However, with this growth, the cases of fraud, phishing attacks and unauthorized transactions have also increased. Because of this, the RBI felt the need to come up with new rules that will prevent such cases as much as possible. 

The new framework of the central bank promotes layered and adaptive security rather than heavily depending on OTPs, which are more susceptible to SIM swaps, phishing and social engineering. 

Balance between Security and User Experience

Finding a balance between security and user experience could be challenging for the banks. Although the intention of the central bank is good, the real test will be how well the framework will be implemented. Banks and fintech companies have to make sure they provide the following to their customers:

• Smooth flows for authentication

• Minimal delays in transaction

• Customer satisfaction

Source: News18