June 22, 2026

Another Layer Of Safety For Senior Citizens In Banking Transactions

By Sunil Garodia
First publised on 2026-06-01 06:03:45

About the Author

Editor-in-Chief of indiacommentary.com. Current Affairs analyst and political commentator. Author of Cyber Scams in India, Digital Arrest, The Money Trap and The Human Hack

View all posts by this Author

India's digital payments ecosystem has long been celebrated for its scale and speed. With over 500 crore UPI transactions processed every month, the country has built one of the most ambitious financial infrastructure stories in the world. But speed and scale came with a vulnerability that fraudsters exploited with devastating efficiency. A single SMS-based OTP was all that stood between a citizen's savings and a criminal's greed. That vulnerability has now been addressed — partially through regulatory mandate, partially through targeted bank-level innovation.

The Old System and Its Fatal Weakness

For years, the standard security architecture for digital payments in India rested on two legs: something you know, such as a PIN or password, and something sent to you, which was almost always an SMS-based one-time password. The OTP became the backbone of digital payment security. It was simple, it was familiar, and it was widely accepted. But familiarity breeds exploitation.

Fraudsters studied the OTP ecosystem carefully and found multiple entry points. SIM swap fraud allowed criminals to clone a victim's mobile number by approaching telecom operators with forged identity documents, after which every OTP meant for the victim was redirected to the attacker's device. Phishing attacks lured users to fake banking portals that harvested both their credentials and their OTPs in real time. Malware installed on smartphones intercepted OTPs silently before the user even saw them. And the most psychologically brutal attack of all, the so-called digital arrest scam, involved fraudsters impersonating law enforcement officers or government officials and coercing terrified victims into reading out their OTPs over the phone.

The scale of damage was no longer marginal. SIM swap fraud alone cost Indian victims nearly fifty million US dollars in 2023. The broader cyber fraud landscape was bleeding citizens of thousands of crores annually. It was clear that a security model built entirely around an SMS message was broken beyond repair.

The RBI's Response: Mandatory Two-Factor Authentication

The Reserve Bank of India had been watching these developments carefully. On September 25, 2025, it issued the Authentication Mechanisms for Digital Payment Transactions Directions, a set of rules that fundamentally reset the security baseline for every digital payment channel in the country. From April 1, 2026, compliance became mandatory for all payment system providers and participants, including banks, non-banking financial companies, payment aggregators, and wallet operators.

The core requirement is straightforward but consequential. Every digital payment transaction must now be authenticated using a minimum of two independent factors. An SMS-based OTP by itself is no longer sufficient. At least one of the two factors must be dynamic, meaning it must be uniquely generated for that specific transaction and cannot be reused. The idea is to ensure that authentication is tied not just to who you are, but to what you are specifically approving in that moment.

The RBI has deliberately not mandated a single prescribed method for the second factor, leaving room for the technology to evolve. The permissible options are broad. A combination of PIN and OTP qualifies. So does a biometric scan paired with a device-bound token. Facial recognition used alongside a password also meets the requirement. What no longer qualifies is any setup where a single SMS-based OTP is the only dynamic element in the authentication chain.

For UPI transactions, the change manifests as a combination of device binding or app-level verification alongside a UPI PIN or biometric. For card transactions, cardholders must pass through two independent verification steps, which can include a PIN, password, device token, or biometric in place of a standalone OTP. For risk-profiled or high-value transactions, banks are expected to trigger additional verification even if the same user has completed low-risk payments seamlessly on trusted devices. As a further security measure, banking applications are now prohibited from allowing screenshots or screen recordings, closing a channel that fraudsters had used to steal visible credentials.

The framework also has a global dimension. For non-recurring cross-border card transactions, the same mandatory two-factor requirement will take effect from October 1, 2026, with card issuers required to validate authentication for international card-not-present transactions whenever requested by an overseas merchant or acquirer.

Alongside the authentication mandate, the RBI has introduced a digital fraud compensation framework. Any bank or payment system participant that fails to meet the prescribed security standards and thereby enables an unauthorised transaction will now be liable to compensate the customer in full. This provision is significant because it converts security compliance from a regulatory obligation into a direct financial risk for institutions that cut corners.

The Dual OTP Feature: Protecting the Most Vulnerable

Running parallel to the general regulatory mandate is a more targeted innovation being implemented by banks specifically for senior citizens and other vulnerable account holders. This is the Dual OTP System, and it addresses a problem that the general two-factor mandate alone cannot fully solve: what happens when the account holder themselves is the weak link?

Digital arrest scams and social engineering attacks are uniquely effective against elderly citizens precisely because the victim cooperates. The fraudster does not need to hack anything. The victim, paralysed by fear or deceived by false authority, simply reads out every OTP they receive. No amount of technical sophistication in the authentication layer helps if the account holder is willingly sharing credentials under psychological duress.

The Dual OTP System is designed specifically for this scenario. Under the framework, when an elderly or registered vulnerable account holder initiates a transaction, the first OTP is sent to their registered mobile number as usual. Simultaneously, a second and entirely separate OTP is sent to a pre-registered trusted contact, typically a family member or a nominated relative. The transaction can only be completed if both OTPs are correctly entered within the defined time window. Neither OTP alone is sufficient.

The implications for fraud prevention are significant. A fraudster who has obtained the victim's OTP through coercion or deception still cannot complete the transaction. The second OTP sits on a different device, belonging to a different person who has not been targeted or manipulated. The family member receiving the second OTP also effectively receives an alert that a transaction is being attempted, creating a window to intervene if something seems wrong. Some banks have extended this further by sending real-time alerts to family members when suspicious or unusually high-value transactions are initiated, even before any OTP is involved.

Why This Architecture Works Against Common Fraud Vectors

Each of the dominant fraud methods active in India today is addressed by some layer of this new framework.

In a SIM swap attack, the fraudster controls the victim's mobile number and intercepts every OTP sent to it. The general two-factor mandate defeats this by requiring a second independent factor, such as a device-bound biometric, that cannot be hijacked through SIM cloning. Even if the SMS OTP is intercepted, the transaction cannot proceed without the second factor. In cases where the Dual OTP System is active, the second OTP goes to a different registered number altogether, making SIM swap attacks against the victim's number insufficient to complete the fraud.

In a phishing attack, the victim is tricked into entering their credentials and OTP on a fake banking portal. The RBI's requirement for transaction-bound authentication partially addresses this. Because the dynamic factor must be unique to the specific transaction, a credential harvested on one fake portal cannot be replayed for a different fraudulent transaction. Over time, as banks move toward in-app encrypted approval notifications instead of SMS codes, the phishing attack surface will narrow further.

In a social engineering or digital arrest scam, the fraudster relies entirely on psychological manipulation rather than technical exploitation. The general two-factor mandate offers limited protection here because a terrified victim can be coerced into sharing any factor they receive. This is precisely why the Dual OTP System exists. The second OTP, held by a trusted family member who is not under duress, cannot be extracted by the fraudster. The transaction is blocked not by technology alone but by the presence of a second, independent human in the approval chain.

What This Means for the Ordinary Account Holder

For most users, the transition will involve some additional friction but will not fundamentally disrupt everyday payments. Low-value transactions on trusted devices may proceed with minimal visible change, as risk-based authentication allows the underlying security layers to remain active without demanding explicit user input for every minor payment. The perceptible change will be most noticeable for high-value or unusual transactions, where an additional verification step will be required.

Senior citizens and those enrolled in the Dual OTP framework will need to coordinate with a trusted family member before registration, ensuring that the nominated contact's mobile number is active, reachable, and in the hands of someone who can respond promptly. Banks are expected to offer this as an opt-in feature with guidance, though the nudge toward registration for elderly account holders should be strong.

The Broader Significance

India's digital payment infrastructure is used by hundreds of millions of citizens, many of whom have no prior experience with formal banking and who approached UPI and mobile wallets as their first point of entry into the financial system. That same accessibility made them targets. The new authentication framework is not a technical upgrade for sophisticated users. It is a structural correction that acknowledges the reality of how fraud actually works in India — through social engineering, through telecom vulnerabilities, and through the exploitation of the least technically protected segments of society.

The mandatory two-factor requirement closes the gap left by a decade of SMS-OTP dependence. The Dual OTP System for senior citizens closes the more dangerous gap that no authentication technology alone can fully address — the gap between a frightened elderly person and a fraudster on the other end of the phone. Together, they represent a meaningful shift in how India's banking system thinks about security — not as a technical problem to be solved with smarter codes, but as a human problem that requires human safeguards built directly into the transaction architecture.