RBI Mandates Two-Factor Authentication for All Digital Payments from April 1, 2026

• RBI introduces new security protocols: Two-factor authentication mandatory for all digital transactions starting April 1, 2026.
• Move aims to combat rising cybercrime and phishing, enhancing security for platforms like UPI and mobile wallets.
• At least one verification factor must be dynamic, generated for a single transaction, with options like biometrics, hardware tokens, and device binding.
• RBI adopts a technology-neutral, principle-driven approach, empowering institutions to use advanced solutions like facial recognition.
• New framework clarifies issuer liability: institutions are responsible for losses from fraudulent transactions if authentication rules are not followed.