Mint Explainer | Will RBI’s two-factor authentication rule curb digital fraud?

Mint explains.From 1 April, all digital transactions must be verified using at least two independent authentication factors—such as a personal identification number (PIN), a one-time password (OTP) or biometric—with at least one factor being dynamic.The requirement applies across payment modes, including cards, UPI and wallets, standardizing security protocols across platforms. The tighter framework is aimed at reducing vulnerabilities and strengthening safeguards in digital payments.Many transactions today rely on a single authentication factor, typically a PIN or an OTP.

The new rule mandates two distinct layers of verification, making it harder for fraudsters to complete transactions even if one credential is compromised. For example, even if someone has access to the OTP, the transaction cannot be completed without the second factor, such as a PIN or biometric check.Previously, OTP-only authentication was sufficient in some cases.

By requiring dual verification, RBI is seeking to close gaps exploited in phishing and SIM-swap frauds, where users are tricked into sharing credentials, thereby raising the bar for transaction security across India’s digital ecosystem.Bank frauds rose to ₹36,014 crore in FY25, a 194% increase in value from a year earlier, according to RBI data. The central bank is tightening authentication standards to curb unauthorized transactions and reinforce trust in digital payments as adoption scales.The move aims to make the financial system more resilient while reducing risks associated with compromised credentials.Banks are upgrading systems to support 2FA and adding additional safeguards at the app and device level.