The RBI’s 2FA rules have applied since 1 April 2026: every domestic digital payment in India must pass at least two separate checks of who you are, unless the RBI lists it as an exemption. They come from the Reserve Bank of India (Authentication mechanisms for digital payment transactions) Directions, 2025, dated 25 September 2025. The exemption list explains why a ₹3,400 tap at a supermarket terminal needs no PIN while a ₹1,299 online order still stops for an OTP.
That list is the part most summaries leave out, and it grew in September 2026, when the RBI added UPI Tap & Pay to it.
What the RBI directions require
The directions cover all payment system providers and participants, banks and non-banks alike, and every domestic digital payment. They set three tests:
- Two distinct factors. Each factor comes from “something the user has”, “something the user knows” or “something the user is”. The RBI’s examples are password, SMS-based OTP, passphrase, PIN, card hardware, software token, fingerprint and other biometrics, device-native or Aadhaar-based.
- One factor must be dynamic for anything other than a card-present payment: the proof sent with the transaction has to be unique to that transaction. A typed password plus a typed PIN would not pass for an online payment.
- The factors must be independent, so that compromising one does not weaken the other.
No factor is prescribed. The RBI’s press release of 25 September 2025 says the framework “does not call for discontinuation of SMS based OTP”, so banks may keep OTPs and add other methods alongside them. Issuers may also run extra risk-based checks on a payment that looks unusual for your location, device or history, and the directions suggest DigiLocker as one way to send and confirm alerts for high-risk payments. If your bank asks for one more confirmation than usual, that is permitted; it is not a sign the payment is fake.
The seven exemptions, and what each means for you
Annexure-1 of the directions lists the payments that do not need two factors. The table pairs each with the rule that sets its terms.
| Payment | Two factors needed? | Rule behind it |
|---|---|---|
| Contactless card tap at a shop | Not up to ₹5,000 a payment; above that, the PIN is asked | RBI circular on contactless card transactions, 4 December 2020; NPCI’s RuPay Consolidated Circular of 18 September 2026, Annexure C |
| Recurring debits under an e-mandate or UPI AutoPay | Registration, the first debit and changes or cancellations made with your bank need two factors; later debits do not, up to ₹15,000 each, or ₹1,00,000 for insurance premiums, mutual fund subscriptions and credit card bills | RBI’s Digital Payments – E-mandate Framework, 2026, dated 21 April 2026; NPCI’s UPI Consolidated Circular, paragraphs 14.11 and 14.12 |
| Gift cards and mobile money-transfer prepaid instruments | No | RBI Master Direction on prepaid payment instruments, 27 August 2021 |
| FASTag toll payments (NETC) | No | RBI letter of 30 December 2019 |
| Small-value payments in offline mode | No, within the offline limits | RBI framework for small-value offline payments, 3 January 2022 |
| Travel bookings on corporate or commercial cards | No | RBI letter to the Indian Banks’ Association, 17 April 2012 |
| UPI Tap & Pay on an NFC point-of-sale terminal | Not up to ₹5,000; above that, the UPI PIN is entered on the terminal | RBI letter to NPCI, 2 September 2026; NPCI’s Tap & Pay page |
The last row is the new one. The RBI’s letter to NPCI is dated 2 September 2026, and the RBI Governor launched Tap & Pay at the Global Fintech Fest on 10 September, according to NPCI’s release. In NPCI’s flow, the merchant keys in the amount, you unlock an NFC-enabled phone and tap it on the terminal, and the payment uses the terminal’s internet connection rather than your phone’s.
Two other things are worth knowing. Turning Tap & Pay on is itself authenticated: NPCI’s page lists entering your UPI PIN as a step in enabling it for an account. And a tap on a UPI Smart QR or Smart Tag, rather than a terminal, follows different rules: small amounts go through UPI Lite if you have it enabled, and anything else asks for your UPI PIN. UPI Lite itself is built for low-value payments “without Additional Factor of Authentication”, while enabling it and topping it up need a second factor (UPI Consolidated Circular, paragraphs 18 and 18.4). The current UPI Lite amounts are on our UPI limits page, and the UPI Lite vs UPI guide explains how the wallet works.
A worked example: one day, seven payments
Here is how the rules play out for one person on one day, assuming her bank and app support each feature and have not set lower limits of their own.
| Payment | Method | Two factors asked? | Why |
|---|---|---|---|
| ₹90 auto-rickshaw fare | UPI Lite | No | UPI Lite runs low-value payments without a second factor |
| ₹3,400 groceries | UPI Tap & Pay on the shop’s terminal | No | Within the ₹5,000 Tap & Pay exemption |
| ₹7,800 shoes | UPI Tap & Pay on the shop’s terminal | Yes: UPI PIN on the terminal | Above ₹5,000 |
| ₹4,500 pharmacy bill | Contactless debit card | No | Within the ₹5,000 contactless card limit |
| ₹1,299 online order | Debit card, card not present | Yes, and one factor must be dynamic, such as an OTP | Online card payments are not exempt |
| ₹12,000 monthly SIP | Card or UPI e-mandate | No (after the first debit) | Mutual fund subscriptions run without a second factor up to ₹1,00,000 |
| ₹18,000 monthly fee | Card or UPI e-mandate | Yes, each month | Above the ₹15,000 general e-mandate threshold |
The pattern is that the exemptions are tied to amount and channel, not to how much you trust the shop. A payment one rupee above a threshold is treated like any other.
UPI PIN or fingerprint
For ordinary UPI payments the second factor is usually your UPI PIN. NPCI’s UPI Consolidated Circular allows device biometrics, such as a fingerprint or face, “in place of, or as an alternative to, UPI PIN” (paragraph 9.1), with three conditions that catch people out:
- you must give fresh consent after every device binding and after adding or re-enrolling a fingerprint or face on the phone (9.4);
- changing or resetting your UPI PIN switches biometric payments off for that account in every UPI app until you turn them on again (9.6); and
- the app makes biometric authentication inactive if you have not used it for 90 days, and asks for your UPI PIN to bring it back (9.8).
If a payment went through without the required checks
Paragraph 9(b) of the directions puts the risk on the issuer: if a loss arises from a transaction carried out without complying with them, the bank or other issuer “shall compensate the customer for the loss in full without demur”. That sits alongside the older RBI rules on liability for unauthorised electronic banking transactions, which still decide how quickly you must report a fraudulent debit. The e-mandate framework applies those same liability rules to recurring debits, and you can stop a mandate yourself; the steps for UPI are in our guide to cancelling UPI AutoPay.
Report to your bank first and keep the complaint number. If the bank does not resolve it, the RBI Ombudsman complaint route is open, and our guide sets out how long you must wait before filing.
Paying abroad with an Indian card
The two-factor rule applies only to domestic payments. For online payments to merchants abroad, the directions required card issuers to have two things in place by 1 October 2026: a way to validate authentication on non-recurring card-not-present payments when the overseas merchant or its acquirer requests it, and a risk-based system for handling all such payments. Whether you see an extra check therefore depends partly on the foreign merchant asking for one.
