Short, dated guides on the rules now arriving and the fraud they answer. Every fact links to its source, with its publisher and period, and secondary sources are marked.
Each guide covers one rule or one attack. The line under each card says which rule it covers and when that rule applies, so a compliance team can file it before reading it.
These guides are written for the people who have to answer for fraud at a bank or a fintech in India, Singapore, Malaysia, the Philippines, Australia, the UAE or Saudi Arabia: the head of fraud, the chief risk officer, the compliance lead and the engineers who build the app. They explain the rules now arriving, from RBI’s Authentication Directions to Australia’s Scams Prevention Framework, and the fraud those rules answer: the coached payment, the mule account, the generated face at sign-up.
Every figure carries its publisher and period. Where the only source is news or trade reporting, the guide says so and asks you to read the regulator’s own text before relying on it. None of the guides is legal advice. DeepID supports compliance and never guarantees it. Where a guide describes what DeepID does, it stays within the modules on the platform page, and the proof is always on your own traffic.
RBI’s directions and NPCI’s rules for UPI, each dated, and the check a bank can run against them.
Two factors as the floor, risk-based checks above it, SMS OTP still valid.
Covers: RBI’s Authentication Mechanisms for Digital Payment Transactions Directions, 2025. In force since 1 April 2026.
As reported, zero liability on negligence and a price on small losses.
Covers: RBI’s amendment directions on limiting customer liability in digital transactions. Apply from 1 January 2027.
What each one proves, how UPI binds today, and the four steps a bank app needs.
Covers: NPCI’s UPI binding, in force, and DoT’s SIM-binding directions for messaging apps, with a deadline reported as 31 December 2026.
Eight controls, the rule each touches, and the module that supports it.
Covers: Eight controls against the rules above, with the status of each: in force, applying later or a proposal.
The fraud the real customer sends, and what the bank shows them when the session calls for it.
Why each check passes alone, and where the scam shows.
Covers: No single rule. The attack behind the liability regimes in India, Singapore, the Philippines and Australia.
What the customer reads at each action, and when a block is right.
Covers: The six actions and the words the customer reads. Singapore’s SRF duties and RBI’s discussion paper show why they are graduated.
How a generated face reaches a face check, and what a face check alone proves.
Six ways a generated face reaches the camera, and what catches each one.
Covers: No single rule. ISO/IEC 30107-3 and CEN/TS 18099, the two standards for testing presentation and injection attack detection.
The same rules arriving market by market: who pays, and what replaces a typed code.
Who pays for scams, from London to Sydney.
Covers: Singapore’s SRF since December 2024, the Philippines’ AFASA since June 2025, India from 1 January 2027 and Australia from 31 March 2027.
RBI, MAS, BNM, BSP and the CBUAE, each dated, and the routes that replace a typed code.
Covers: RBI’s 2025 directions, MAS’s OTP phase-out, BNM’s measures, BSP Circular 1213 and the CBUAE’s move off SMS, each dated.
The dates these guides are written around, each linking the market page that carries the rule. Deadlines that have passed stay on the list, marked.
The reported full phase-out of SMS and email OTP by UAE banks.
Gulf News (New rule: UAE banks to stop sending OTPs via SMS and email from July 25, opens in a new tab), 2025, press reportBeyond SMS OTP
RBI’s Authentication Directions came into force.
RBI (Press release: directions on authentication mechanisms for digital payment transactions, opens in a new tab), Sep 2025RBI’s Authentication Directions
BSP Circular 1213’s deadline to replace SMS and email OTP for high-risk transactions.
GMA News (No more SMS, email OTPs for high-risk financial transactions, opens in a new tab), 2025, press reportBeyond SMS OTP
DoT’s SIM-binding deadline for messaging apps, as reported. Context for banks, not a bank obligation.
Angel One (DoT extends SIM-binding deadline for WhatsApp, Telegram and Signal till year end, opens in a new tab), 2026, press reportSIM and device binding
RBI’s amendment directions on customer liability apply to digital transactions.
RBI (Press release: amendment directions on the review of the framework of limiting customer liability in digital transactions, effective 1 January 2027, opens in a new tab), Jun 2026RBI’s 2027 liability framework
Most obligations of the Scams Prevention Framework start for banks, telcos and digital platforms.
ACCC (Scams Prevention Framework, opens in a new tab), as of Oct 2026Liability by market
Pick one, test it on your own traffic before you commit, and add the others on the same SDK when you’re ready.