Why do customers get an OTP or extra check when they pay by card in India?
By the Menuthere editorial team · Last updated
The Reserve Bank of India requires at least two checks on domestic digital payments, and at least one must be dynamic for card payments online. SMS OTP is no longer the only option.
- The rule applied from 1 April 2026.
- It covers online card payments where the card is not present.
- A few payments are exempt, such as small contactless card taps and repeat e-mandate debits after the first.
- If a loss arises from a payment that did not follow the rules, the bank compensates the customer.
- You do not control the check. The bank and the gateway run it on the payment page.
Checks run on the payment page
On a Menuthere link customers pay on your own gateway's payment page, which runs these checks for the card, so you do not build or manage verification yourself.
Next questions
Sources (1)
- RBI Authentication Directions 2025: all domestic digital payments, Reserve Bank of India, 25 September 2025