RBI’s Authentication Directions, 2025, signals the phasing out of OTP-only second-factor authentication for payments, prioritizing enhanced security and user choice. The new framework encourages biometrics, app-based tokens, and device-native methods, shifting liability to issuers. Banks and payment providers must adopt alternative 2FAs by April 2026 for domestic transactions and October 2026 for cross-border payments.