RBI rolls out new authentication methods for digital payments, alternatives to SMS-based OTPs: Check details

tech.hindustantimes.com:

The Reserve Bank of India (RBI) has introduced a new Framework on Alternative Authentication Mechanisms for Digital Payment Transactions to bolster online payment security. This initiative emphasises the importance of Additional Factor of Authentication (AFA) in protecting digital transactions.

Authentication Factor Aggregation (AFA) involves using multiple factors to verify payment instructions. Traditionally, SMS-based One-Time Passwords (OTPs) have been the most common method for AFA in digital payments. However, advancements in technology have led the RBI to explore alternative authentication methods.

Also read: Sonova launches first of its kind hearing aid with real-time AI: Here's how it works

On July 31, 2024, the RBI announced the new framework, which underscores the need for AFA while recognizing the potential of other technological solutions to enhance security. Authentication factors are divided into three types by the framework:

1. Knowledge-based: Information known to the user, such as passwords, passphrases, or PINs.

2. Possession-based: Items the user possesses, such as hardware or software tokens.

3. Inherence-based: Attributes unique to the user, such as fingerprints or other biometrics.

Also read: iPhone, Mac and iPad users, update software urgently to avoid getting hacked - Check Indian Government's alert

The framework allows issuers, including banks and non-banks, to use a risk-based approach to determine the appropriate AFA for each transaction. Considerations include transaction value, origination channel, and the risk profiles of the customer and beneficiary. Issuers must promptly notify customers of eligible digital payment transactions.

Certain low-risk transactions are exempt from AFA requirements under the new framework. These include:

1. Small-value contactless card payments up to ₹5,000 at Point of Sale (PoS) terminals.

2. E-mandates for recurring transactions in specific categories and limits, such as:

Also read: Elon Musk takes OpenAI to court,