Overview
- Starting April 1, 2026, every UPI, card, and wallet transaction in India must pass two checks, which ends OTP-only approvals.
- Each payment must use two independent factors, with at least one dynamic element such as an OTP, a biometric scan, or a device-based token.
- Banks and payment apps will use risk-based checks, so routine payments on trusted devices should feel familiar while new devices or high-value purchases may prompt extra steps.
- Issuer liability rises under the new framework, and banks or platforms may have to repay customers when fraud stems from their own system failures.
- Similar protections will cover cross-border card-not-present payments by October 1, 2026, a shift driven by phishing and SIM-swap scams that exploited SMS-only verification.