RBI’s 2025 authentication directions will, from 1 April 2026, force every domestic digital-payment transaction to use two independent factors, one of which must be dynamically generated. At a time when the UPI network handled more than 21.6 billion transactions in December 2025, the rule aims to eliminate SMS-based one-time passwords (OTPs) and push the industry toward phishing-resistant passkeys.

Why the RBI moved

The RBI’s new directions join a string of Indian policy moves targeting weak credential practices. The DPDP Act 2023 slapped steep penalties on data breaches, and CERT-In recently required identity-theft incidents to be reported within six hours. Both regulations give firms a financial reason to replace reusable passwords and easily intercepted OTPs with something harder to steal.

The RBI’s specific requirement—two independent factors, one dynamically generated—means a static password or PIN no longer satisfies compliance. A dynamically generated factor must be produced at the moment of authentication, which rules out the traditional SMS OTP flow. Passkeys, built on public-key cryptography, meet the rule because the device creates a fresh signature for each login attempt.

What a passkey actually is

A passkey stores a private cryptographic key on the user’s device. The key never leaves the device; instead, the device signs a challenge presented by the website or app. The signed response proves possession of the private key without exposing any secret that could be replayed elsewhere. Biometric data—fingerprint, face scan, or a PIN—may unlock the device, but the authentication itself relies on the cryptographic handshake, not on the biometric.

Three common attack vectors disappear with passkeys:

  • Password reuse or theft – there is no shared secret to steal.
  • SMS interception or phishing – the challenge-response exchange cannot be replayed on a fraudulent site.
  • Site-specific phishing – a passkey is bound to a particular domain; a look-alike site cannot validate the key.

Drivers behind the shift

  1. RBI’s mandate – the regulatory push is the most immediate catalyst.
  2. DPDP Act 2023 – heavy fines for credential leaks make passkeys an attractive risk-mitigation tool.
  3. CERT-In reporting rules – faster detection of account takeovers reduces operational fallout.

Together they create a cost-benefit equation that favours early adopters.

Industry response so far

  • Card networks – Mastercard and Visa have begun rolling out payment-specific passkey services, positioning themselves as compliant facilitators.
  • Consumer platforms – Google, Amazon and WhatsApp already support passkeys for Indian users, giving the technology a foothold outside banking.
  • Banks – adoption is uneven. Larger banks with modern tech stacks have piloted passkey login, while many regional players still rely on SMS OTPs.

The most promising arena is India’s digital public-infrastructure. If Aadhaar or DigiLocker integrate passkeys, the country could become the first to secure billions of citizen identities with a single, large-scale cryptographic system.

The hidden challenges

  • User habits – decades of OTP usage have conditioned consumers to expect a text message. Convincing them to switch to device-based credentials will require clear education and smooth fallback flows.
  • Biometric confusion – many users equate a fingerprint scan with a passkey, not realizing the scan only unlocks the device’s stored key. Misunderstanding can erode trust if a scan fails and the transaction is blocked.
  • Legacy system upgrades – banks must retrofit core banking and UPI gateways to accept public-key signatures, a task that can run into millions of dollars and months of testing.
  • Device fragmentation – a sizable portion of the Indian market still runs on older smartphones that lack secure enclave hardware needed for passkey storage. Those users risk being left out of the new compliance regime.

Bottom line

The RBI’s April 2026 deadline turns a regulatory phrase—“two independent factors, one dynamic”—into a practical demand for cryptographic passkeys across India’s digital-payment ecosystem. The move aligns with broader data-protection laws and rapid-reporting requirements, creating a strong incentive for banks and payment providers to overhaul legacy authentication. Success will hinge on navigating user expectations, legacy-system costs, and device coverage.