RBI’s new rules for two-factor authentication of digital payments; Check alternative methods proposed

Synopsis

The Reserve Bank of India has made securing digital payments a top priority, emphasizing the need for Additional Factor of Authentication (AFA) when making payments. Authentication did not require any particular criteria.

In order to allow the ecosystem to use different forms of authentication, the RBI has announced a draft on “Framework on Alternative Authentication Mechanisms for Digital Payment Transactions”.
The Reserve Bank of India has made securing digital payments a top priority, emphasizing the need for Additional Factor of Authentication (AFA) when making payments. Authentication did not require any particular criteria.

These 10 transactions will be reported as fraud to RBI, as per new rules
According to an RBI press release issued on July 31, 2024, “ the Reserve Bank of India has prioritised security of digital payments, in particular the requirement of Additional Factor of Authentication (AFA) for making payments. No specific factor was mandated for authentication, but the digital payments ecosystem has primarily adopted SMS-based OTP as AFA. While OTP is working satisfactorily, technological advancements have made available alternative authentication mechanisms.”
As per the draft, “Factor of Authentication: Any credential input by the customer which is verified for the purpose of confirming the originator of a payment instruction.

Invest and Earn on ET Money - Get up to 9.5% p.a. returns

The factors of authentication are broadly categorised as below:
  • Something the user knows (such as password, passphrase, PIN)
  • Something the user has (such as card hardware or software token)
  • Something the user is (such as fingerprint or any other form of biometrics).”
Unless otherwise specified in this framework, all digital payment transactions will be verified through the use of an additional factor of authentication (AFA). When determining the proper AFA for a transaction, issuers such as banks, non banks can use a risk-based methodology that takes into account the transaction value, origination channel, customer and/or beneficiary risk profiles, among other factors. Issuers must have a mechanism in place to notify customers of any eligible digital payment transactions almost instantly, as per the draft.

These are exempted from customer authentication:
Small value contactless card payments:
Small value card present transactions for values upto Rs 5000/- per transaction in contactless mode at Point of Sale (PoS) terminals.
E-mandates for recurring (other than the first) transactions:
Transactions in respect of:
a) subscription to mutual funds;
b) payment of insurance premium and
c) credit card bill payments, for values upto Rs 1,00,000, and in respect of all other categories, for values upto Rs 15,000/-.
Prepaid Instruments (PPIs) issued under PPI – Mass Transit Service and Gift PPIs.
Transactions in the National Electronic Toll Collection (NETC) System

Small value digital payments in offline mode:
Offline payment transactions up to a value of Rs 500/-.

Comments

Popular posts from this blog

Senior Citizen Train Ticket Discount: Government has issued a new statement regarding giving discount to senior citizens on train tickets, know the details here

Cash Transaction Rules: Income tax rules on cash transaction between Husband-Wife and Son-Father, know rules

Have a Current/Savings Bank Account? Know the Cash Deposit Limits under Income Tax Act to avoid Penalties and Notices