RBI's two-factor authentication for all digital transactions becomes operational

The two-factor authentication has been introduced to reduce bank fraud and improve accountability.

The two-factor authentication mandate by the Reserve Bank of India (RBI) is taking effect from April 1, 2026 as a major step toward curbing fraud.

According to RBI, all digital payment transactions are required to meet the norm of two-factor authentication. Transactions will only be processed if the user completes both verification steps, meaning even if someone sees your PIN, unauthorised payments will not be able to go through.

The RBI introduced two-factor authentication (2FA) to reduce bank fraud and improve accountability. "All payment system providers and payment system participants, including banks and non-bank entities, will ensure compliance with these directions by April 01, 2026," it had said.

What does two-factor authentication mean?

UPI has always followed a two-factor authentication framework: the first factor is the mobile number linked to the user’s bank account and the second is the UPI PIN.

Besides, users cannot take screenshots or screen recordings in the banking app, as they are banned to protect the user from any fraud.

"In an ecosystem like UPI, where transactions settle in seconds, the only meaningful window to act is before the transaction is completed," Anil Tadimeti, Director, (Strategy & Regulatory Affairs), Bureau said.

"This is where authentication needs to evolve. Trust has to be established through context, by combining who you are, what you know, and what you have, and evaluating these signals in real time."

(With PTI inputs)