UPI, Online Payment Rules Changed In India From April 1, OTP Alone Won’t Work: Know RBI’s New Rules

From April 1, 2026, a wide range of digital payment and banking rules have changed across India, with the Reserve Bank of India (RBI) rolling out a stricter security framework aimed at curbing fraud and improving accountability. The biggest shift is in the way people authorise online payments, as one-time passwords (OTPs) by themselves will no longer be enough for many transactions.

The updated rules affect UPI, debit and credit cards, mobile wallets, recurring payments, and even certain banking services. Alongside the RBI's changes, the National Payments Corporation of India (NPCI), Indian Railways, NHAI, and PAN authorities have also introduced fresh norms that users need to be aware of from the first day of the new financial year.

RBI Makes Two-Factor Authentication Mandatory for Digital Payments

The RBI's new digital payment framework now requires all online transactions, including those made through UPI, cards, and wallets, to be authenticated using at least two independent factors.

Under the revised system, OTP will continue to be used, but only as one part of the verification process. Users must now complete an additional authentication step such as a PIN, password, biometric check, or secure token before a payment is approved.

This means OTP-based approval alone is no longer considered sufficient, as the RBI seeks to reduce fraud linked to phishing, SIM swap scams, and other methods that have increasingly targeted users of digital payment platforms. While the new process may add an extra step to transactions, it is designed to offer stronger protection against unauthorised access.

Risk-Based Checks to Decide How Strict the Verification Will Be

To avoid making every payment cumbersome, banks and payment service providers will follow a risk-based authentication model under the new rules.

For low-risk transactions, such as routine small-value payments made from trusted devices, the process may remain relatively quick and smooth. However, transactions flagged as high-risk, such as large-value payments or those initiated from a new or unfamiliar device, may trigger additional verification layers.

This approach is intended to maintain convenience for day-to-day payments while tightening scrutiny where fraud risks are higher.

Banks and Payment Platforms Face Greater Accountability

The RBI has also increased the responsibility of banks and payment platforms under the new framework, making them more accountable for the security of their systems.

If fraud takes place because of system failures or lapses on the part of the institution, banks and payment service providers may now be required to compensate affected users. This could also result in faster resolution of complaints and stronger grievance redressal in fraud-related cases.

The broader objective is to ensure that institutions do not merely process transactions, but also take greater ownership of the security infrastructure supporting them.

UPI Limits, Auto-Debit Timings and Other Key Changes From April 1

Apart from the authentication overhaul, NPCI has introduced several operational changes to improve efficiency and reduce system load on UPI networks.

Users can now perform a maximum of 50 balance checks per app in a single day. On a single UPI app, no more than 25 bank accounts can be linked in a day. For pending transactions, status checks are now restricted to three attempts, with a mandatory 90-second gap between each check.

Recurring payments such as EMIs and subscription debits will also be processed during non-peak hours, including before 10 AM or after 9:30 PM, to ease pressure on the system during high-traffic periods.

There are also a number of other financial changes now in effect:

• ATM withdrawals: Banks such as HDFC Bank will now count UPI-based cardless ATM withdrawals within the monthly free transaction limit. Once the free limit is exhausted, a charge of Rs 23 plus applicable taxes will apply.
• RuPay lounge access: Holders of RuPay Platinum debit cards will no longer be eligible for airport or train lounge access from April 1.
• International digital payments: Similar two-factor authentication rules will also be extended to cross-border transactions, with full implementation required by October 1, 2026.

Rail Ticket Refunds, FASTag Fee Hike and New PAN Rules Also Kick In

Several non-banking but financially relevant changes have also come into effect from April 1.

Indian Railways has revised its ticket cancellation rules by reducing the refund window for confirmed tickets. Passengers who cancel within eight hours of departure will now receive no refund, compared with the earlier four-hour threshold.

The revised structure is as follows:

• Within 8 hours of departure: No refund for confirmed tickets
• 8 to 24 hours before departure: 50% refund, with 50% treated as penalty
• 24 to 72 hours before departure: 75% refund, with 25% penalty
• More than 72 hours before departure: Maximum refund, subject to flat deduction
• Waitlist/RAC tickets: Cancellation rules remain unchanged up to 30 minutes before departure

Meanwhile, the FASTag annual pass fee has been increased by the National Highways Authority of India (NHAI) from Rs 3,000 to Rs 3,075 for FY 2026-27, effective April 1.

New PAN card application rules have also come into force. Aadhaar-only applications are no longer valid, and applicants must now submit an additional proof of birth such as a birth certificate or passport. Authorities have also made it mandatory for the PAN name to exactly match Aadhaar records, while new category-specific forms, Forms 93 to 96, are now required depending on the applicant type.

In short, April 1, 2026 marks a major shift in how Indians make digital payments and manage routine financial services. While the headline change is that OTP alone will no longer be enough, the wider set of rules reflects a broader push towards tighter security, reduced fraud risk, and stricter institutional accountability across the financial ecosystem.