Why OTP Alone Won't Work Anymore: RBI's New Digital Payment Rules Explained

Starting April 1, 2026, several significant changes to digital payment and banking rules in India have come into effect as the Reserve Bank of India has introduced stricter rules aimed at reducing fraud and strengthening accountability. Under the new framework, two-factor authentication (2FA) will become mandatory for all digital transactions, fundamentally changing how users pay via UPI, cards, and mobile wallets.

The move comes in response to the growing risks associated with OTP-based systems, which have become vulnerable to fraud techniques such as phishing and SIM swap scams.

Mandatory Two-Factor Authentication

The RBI's new framework requires every digital payment (UPI, cards, or wallets) to be verified using at least two independent factors. Under the revised rules, OTP will remain one component of authentication, but it must be combined with another independent verification step.

This means one-time passwords (OTPs) alone will no longer suffice, and every transaction will require an additional verification layer such as a PIN, password, biometric authentication, or secure token. In effect, all payments will pass through two levels of security, making the process slightly longer but significantly safer.

Risk-Based Authentication

To balance security with convenience, banks will use a risk-based approach. 

• Low-Risk: Transactions from trusted devices or routine small payments may remain quick and seamless.
• High-Risk: Large payments or those made from new devices may trigger additional verification steps

 Increased Bank Accountability

Alongside this, the RBI has also tightened accountability norms, placing greater responsibility on banks and payment platforms to ensure secure systems.

• Fraud Compensation: In cases where fraud occurs due to system failures or lapses, institutions may be required to compensate users, potentially leading to faster grievance redressal.
• Faster Resolution: These rules aim to ensure quicker resolution of fraud-related complaints.

UPI Operational Rules

The National Payments Corporation of India (NPCI) has introduced several efficiency-focused limits. 

• Balance Check Limits: Users are capped at 50 balance checks per app, per day to prevent system overload.
• Account Linking: You can link a maximum of 25 bank accounts per day on a single UPI app.
• Status Check Gaps: Pending transaction status can only be checked 3 times, with a 90-second mandatory gap between each attempt.
• Auto-Debit Timing: Recurring payments like EMIs and subscriptions will now be processed during non-peak hours (e.g., before 10 AM or after 9:30 PM).

Other Banking and Financial Changes

• ATM Charges: Retailers like HDFC Bank will now count UPI-based cardless withdrawals toward your monthly free transaction limit, after which a fee of Rs 23 plus taxes applies.
• Lounge Access: RuPay Platinum debit card holders will no longer have access to airport or train lounges as of today.
• International Payments: Similar 2FA rules will be extended to cross-border transactions, with full implementation required by October 1, 2026.

Train Ticket Cancellation Rules

Beyond digital payments, other financial and travel-related changes are also coming into effect. Indian Railways has revised its ticket cancellation policy, reducing the refund window. Passengers cancelling tickets within eight hours of departure will no longer be eligible for refunds, compared to the earlier four-hour cutoff.

• Within 8 hours of departure: 0% refund (no refund for confirmed tickets)
• 8 to 24 Hours Before: 50% refund (50% penalty).
• 24 to 72 Hours Before: 75% refund (25% penalty).
• More than 72 Hours Before: Maximum refund (flat deduction).
• Waitlist/RAC: Rules remain for cancellation up to 30 minutes before departure.

FASTag Annual Pass Fee Hike

Meanwhile, the National Highways Authority of India has increased the FASTag annual pass fee from Rs 3,000 to Rs 3,075 for the financial year 2026–27, effective April 1.

New PAN Card Rules

From April 1, 2026, new PAN card rules make Aadhaar-only applications invalid, requiring additional proof of birth. Applicants must provide supporting documents like a birth certificate or passport. Additionally, the name on the PAN must match Aadhaar, and new category-specific forms (Form 93-96) are mandatory.