RBI Issues New Digital Fraud Guidelines
The Reserve Bank of India has issued new guidelines for payment platforms to combat rising cyber fraud. The RBI is pushing for stronger user authentication, better transaction monitoring, and more robust education for both merchants and consumers to secure the digital payments ecosystem.
The latest RBI directives are a response to a dramatic spike in digital fraud, with losses soaring to ₹22,845 crore in 2024, a 206% increase from the previous year. The sheer volume of incidents crossed 2.2 million, underscoring the urgency for a systemic overhaul of security protocols. A cornerstone of the new framework, effective April 1, 2026, is the move beyond SMS-based OTPs for two-factor authentication (2FA). The guidelines encourage the adoption of modern, alternative authentication methods, allowing for more robust, risk-based checks that analyze user behavior, location, and device information to assess transaction risk in real-time. Payment Aggregators (PAs) are now under stricter scrutiny with the Master Direction issued on September 15, 2025. These entities must now implement board-approved information security policies, comply with PCI-DSS standards, and undergo annual cybersecurity audits by CERT-In empanelled auditors to continue their operations. The new rules also place greater responsibility on banks and payment platforms to protect consumers. Any financial loss to a customer resulting from non-compliance with the new authentication norms must be fully compensated by the issuer, reinforcing accountability across the payments ecosystem. Merchants will also feel the impact of these tightened regulations. Payment Aggregators are now required to conduct more thorough due diligence before onboarding merchants and are mandated to monitor their transactions continuously to prevent fraudulent activities. In a related move to curb fraud, the RBI has intensified its focus on Know Your Customer (KYC) norms. Amendments made in June and August 2025 streamline the periodic updation process for low-risk customers while empowering business correspondents to assist with KYC processes in rural and semi-urban areas to ensure wider compliance.
