RBI's New OTP Rule for Foreign Card Payments From 1 October
From 1 October 2026, RBI requires an extra authentication step on foreign card payments. What changes, why some needed no OTP before, and what to check now.
By Balaji Anbazhagan
· 5 min read
On this page
From 1 October 2026, the RBI requires banks and card networks to apply an additional factor of authentication (AFA) — in practice, an OTP or an app-based approval — to non-recurring, cross-border card-not-present (CNP) payments, whenever the overseas merchant or its acquirer asks for it. Until now, many foreign websites and apps could charge an Indian card without this extra step, because India’s OTP rules applied fully only within the country. Here is what changes, and what to check before the deadline.
The short answer
- What changes: cross-border, one-time (non-recurring) card-not-present payments must support an extra authentication step from 1 October 2026, when the overseas merchant or acquirer requests it.
- Domestic transactions: two-factor authentication has already been mandatory for all payment system providers and participants since 1 April 2026.
- Why it matters: a category of foreign online payments that could bypass Indian OTP checks is being closed.
- It is risk-based, not blanket: the RBI has moved from a fixed rule to a risk-based model, so issuers can also use device reputation, location and transaction history instead of an OTP every time.
- What to do: make sure your registered mobile number and banking app are up to date before 1 October, especially if you shop or subscribe internationally.
Why international transactions needed no OTP until now
India’s two-factor authentication requirement for card payments has applied mainly to domestic transactions since 2009. Many international websites route payments through their own or a foreign acquirer’s system, which does not always support India’s OTP flow — so purchases on some overseas sites and subscriptions went through with just the card number, expiry and CVV, no OTP. This gap made such payments an easier target for card fraud if your card details were ever exposed. The RBI’s new deadline extends the extra-authentication requirement to these cross-border, card-not-present payments too.
Domestic vs international: the two deadlines
| Transaction type | Two-factor authentication mandatory from |
|---|---|
| Domestic card and digital payments | 1 April 2026 |
| Cross-border, non-recurring, card-not-present payments | 1 October 2026 |
Recurring cross-border payments (an international subscription you already approved once) work under a separate framework and are not the focus of this October deadline.
What “risk-based” authentication means
The RBI is not mandating an OTP for every single transaction. Issuers can use a risk-based approach: signals such as your device’s history with that bank, IP location, and your usual spending pattern can be used to decide whether a transaction needs a full OTP step or can go through with lighter checks. A first-time high-value payment to an unfamiliar overseas merchant is far more likely to trigger an OTP than a small, repeat charge from a service you use every month.
What this means for you
- Overseas shopping and subscriptions: expect an OTP or app approval prompt on some international card payments that previously went through instantly, when the merchant or its acquirer requests AFA.
- Failed payments are possible: if an overseas merchant’s payment system is not yet set up to pass through Indian OTP requests properly, some transactions could fail at checkout. Keep an alternate payment method handy for the first few weeks.
- Keep your mobile number current: OTPs go to the mobile number registered with your bank. If you have changed your number and not updated it, update it before 1 October.
- Update your banking app: app-based approval (instead of SMS OTP) is faster and more reliable when travelling or on weak mobile signal.
A separate change: high card spending and your tax return
Under the Income Tax Act, 2025 (effective 1 April 2026), credit card spending is tracked through the Statement of Financial Transactions (SFT) framework, and large annual card spends can be reported to the tax department. This is not a new tax — spending more does not by itself create a tax liability — but a large mismatch between your declared income and your card spending can attract a query from the department. It is a separate rule from the AFA change above, but both fall under the same wave of 2026 card-related tightening.
What to do before 1 October
- Confirm the mobile number linked to your bank account and cards is current.
- Install or update your bank’s app so you can approve payments even if an SMS OTP is delayed.
- If you have a recurring overseas subscription, check that your last renewal went through without issues; if it failed once already, contact your bank.
- Keep a second card or UPI-linked option ready for the first few international purchases after 1 October, in case a merchant’s checkout has teething trouble with the new step.
Frequently asked questions
Do I need to do anything before 1 October 2026? Mainly make sure your registered mobile number and bank app are current. The authentication itself is handled by your bank and the merchant’s payment system.
Will every foreign card payment now ask for an OTP? Not necessarily. The RBI allows a risk-based approach, so low-risk, familiar transactions may not need a full OTP every time, while unfamiliar or high-value ones are more likely to.
Does this apply to UPI or only cards? This specific 1 October deadline is about cross-border, card-not-present card transactions. Domestic UPI and card payments already require two-factor authentication since 1 April 2026.
Will my international subscriptions stop working? They should keep working, but a subscription could see a failed renewal if the merchant’s system is not yet passing through the authentication step correctly. Check your card statement after 1 October and contact your bank if a legitimate renewal fails repeatedly.
Sources
- Business Standard, “RBI mandates stronger two-factor authentication in new guidelines”: business-standard.com
- Upstox, “RBI makes two-factor authentication mandatory for digital payments from April 1, 2026”: upstox.com
- Reserve Bank of India, payment and settlement systems circulars: rbi.org.in
This article is for general information and education, not financial, tax or investment advice. Rules and rates change; check official sources or consult a qualified professional before acting. See our disclaimer.