Banks are required to comply with the new guidelines with effect from February 1, after which the customers would be declined any telephonic transaction for their credit cards without an additional One-Time Password (OTP).

The Reserve Bank of India's directive was earlier scheduled to come into effect from January 1, but the deadline was extended by one month after some banks sought additional time to put the required changes in their systems in place.

After consultations among its top officials, as also with the bank representatives, RBI gave banks time till February 1 for putting the new security measure in place.
The OTP will now be required for all credit card transactions over phone, including payments and automated IVR (Interactive Voice Response) services.

The OTP will be valid for a single use and would remain in effect for a period of two hours. The customers would need to generate a separate OTP for each IVR transaction.

After the new security layer, the customers would need at least five sets of numbers to conduct a credit card transaction over phone -- the 16-digit card number, card expiry date, CVV (Card Verification Value, which is printed on the back of the card) number, mobile number and the OTP.

The new step has been taken as a safeguard against credit card frauds. There has been an uptick in credit card frauds, where lost or stolen cards can be used by anyone.

For transactions where cards are needed to be presented physically, the RBI has already made it mandatory for an identity verification and the signature also needs to be matched with that on the card.

But phone and internet banking have been a matter of grey areas in terms of their misuse.

The added security layer for phone banking follows a similar step taken by the banks for internet banking transactions.

Last year, RBI had made it mandatory for banks to put in place an additional security layer for all credit card transactions over the internet.

Banks are already communicating to their customers to get the OTP for their phone banking transactions. The customers will be prompted to get the OTP whenever they initiate a phone banking transaction tomorrow onwards.

The password will be sent only to the registered mobile number and email address of the customer.