If you are one of those who quickly tap their phone to pay for morning chai, an auto ride or grocery shopping through UPI, today brings a small but important shift that could save your hard-earned money from fraudsters.
From April 1, 2026, the Reserve Bank of India has made two-factor authentication (2FA) compulsory for all UPI transactions. Earlier, entering just your UPI PIN was enough to complete the payment. Now, you will need a second layer of security — either an OTP sent to your registered mobile, fingerprint scan, or face ID — before the money actually leaves your account.
This “double lock” system applies across popular apps such as PhonePe, Google Pay, Paytm, CRED, BharatPe, and other UPI platforms. Even small payments of ₹20 or ₹50 at roadside stalls will now ask for that extra confirmation. Yes, it may take a few extra seconds, but RBI’s move aims to make digital payments much safer in a world where UPI fraud cases are rising fast.
Fraudsters who somehow get hold of your UPI PIN will now find it almost impossible to siphon off money without the second factor. For new users, the first 24-hour limit remains capped at ₹5,000 as an added safety measure. Daily transaction limits remain the same — generally up to ₹1 lakh, and higher for essential payments such as hospital bills or school fees.
There is also a related change for cash lovers. Banks such as HDFC have started counting UPI-based cardless cash withdrawals at ATMs within the monthly free withdrawal limit. Cross the free quota, and you may now pay the usual ATM charges.
Experts say the slight inconvenience is worth it for protecting millions of users who rely on UPI every day. So next time you scan a QR code, remember — that extra tap or fingerprint is RBI’s way of guarding your wallet in the digital age.