Kolkata, New Delhi, INDIA. New York, USA.
Business To Business, Mumbai, 25 September 2025: The Reserve Bank announced on Thursday that new regulations concerning digital payment security will take effect from April 1. These revised rules will broaden the spectrum of permissible methods for two-factor authentication (2FA), extending beyond the traditional SMS-based one-time password (OTP).
According to the central bank, authentication factors may derive from "something the user possesses," "something the user knows," or "something the user is." These could include, but are not limited to, passwords, SMS OTPs, passphrases, PINs, hardware cards, software tokens, fingerprints, or any other biometric identifiers—whether device-native or Aadhaar-based.
India remains among the few global markets that mandate 2FA, with financial institutions predominantly relying on SMS alerts to authorize transactions.