UPI Payments Need Two-Step Verification From April: New RBI Security Rule
Last Updated: April 10, 2026, 5:52 PM IST.
Your UPI payment may now take a few extra seconds to complete. The Reserve Bank of India has made two-factor authentication mandatory for all digital transactions from April 1, 2026.
If you have noticed your Google Pay, PhonePe, or Paytm taking slightly longer to process payments above ₹10,000 in the last few days, this is the reason. The RBI has enforced a new security framework where OTP alone is no longer sufficient to complete a digital payment.
Every transaction now requires two separate layers of verification before it goes through. Under the new rule, your banking app may ask for your UPI PIN plus a biometric scan such as fingerprint or face recognition. In some cases, the app may generate a one-time code as the second factor instead of biometric. This applies to all payments made through UPI, debit cards, credit cards, and mobile wallets across India.
The RBI introduced this change to combat rising cases of phishing, SIM swap fraud, and unauthorized transactions. With over 350 million UPI users in India and digital payments growing rapidly, the central bank decided that single-factor authentication was no longer safe enough. According to recent security guidelines, banks must ensure that the two factors are independent of each other to maximize protection.
Who Is Affected
Every person using UPI, net banking, or card payments in India is affected. The rule applies to all banks and payment platforms without exception. If your payment app has not yet updated to the new flow, it will in the coming days as banks complete their backend integration.
For payments below ₹2,000, some platforms may still allow single-factor authentication for now. But for any transaction above ₹2,000, expect the additional verification step. Cross-border card payments will also require two-factor authentication by October 2026.
If you encounter a failed payment during this transition, do not worry. Most errors are due to outdated app versions that do not support the new two-step prompt. Check your official status and retry after updating your application.
What You Should Do
Update your banking app to the latest version. Ensure your mobile number linked to your bank account is active because OTPs and verification codes are sent to this number. If you use biometric authentication, make sure your fingerprint or face ID is registered in your banking app. Verify if your bank has adjusted your daily limits for high-value transfers under these updated security protocols.
You Need to Know: Two-factor authentication is mandatory from April 1 for all digital payments. OTP alone will no longer complete a transaction. Payments may take 5 to 10 seconds longer than before. The rule applies to UPI, debit cards, credit cards, and wallets. Cross-border transactions will follow the same rule from October 2026. The change is designed to reduce fraud, not to block your payments.
This is one of several financial changes that took effect this month. Read our full guide on money rules changing from April 1 for the complete list including ATM limits, PAN card rules, and railway refund changes. For the official RBI circular on digital payment security, visit rbi.org.in.
Read Next: Check how the RBI MPC meeting repo rate decision today affects your EMI and savings. Also see if banks will be closed 4 days in a row starting April 11 in our bank holidays list.
