From April 1, RBI mandates 2FA for UPI, cards, wallets
Business
From April 1, 2026, paying with UPI, cards, or wallets will need two-factor authentication (2FA), so not just an OTP, but also something extra like a PIN or fingerprint.
The Reserve Bank of India says this is to make online payments safer and cut down on fraud.
Banks and platforms may compensate users
The new rules are a response to rising scams like phishing and SIM swaps that trick OTP systems.
Banks and payment platforms may be required to compensate users if fraud occurs due to system failures or lapses, and higher-risk transactions will get extra checks.
International payments will also need 2FA by October 2026.
Plus, Indian Railways has tweaked its ticket refunds: Now you'll only get your money back if you cancel at least eight hours before departure.