RBI’s Authentication Directions have been in force since 1 April 2026, and the revised customer-liability framework applies from 1 January 2027. Six dated rules are mapped here, each with its status and public source, to the controls they call for and the DeepID modules that support them. DeepID supports compliance and never guarantees it.
Named for orientation. Which routes are live with which operator is confirmed with you before a pilot.
Phone numbers, payees and amounts are the illustrative values this site uses for India.
Each rule with its date, its status, what it asks of a bank and the controls it calls for. A proposal is listed for what it would touch, and never marks the map.
Every digital payment is authenticated with two distinct factors, one of them created for that transaction. Issuers may add risk-based checks that weigh location, behaviour, device attributes and transaction history. SMS OTP stays a valid factor and newer ones are encouraged.
Calls for: Beyond SMS OTP, Risk-based checks.
Source: RBI (Press release: directions on authentication mechanisms for digital payment transactions, opens in a new tab), Sep 2025; RBI (Authentication Mechanisms for Digital Payment Transactions Directions, 2025, opens in a new tab), Sep 2025
App-based messaging services must work only while the registered SIM is present and active in the phone. The compliance date was reported in April 2026 as 31 December 2026. UPI apps already bind to the SIM and the device.
Calls for: Device and SIM binding.
Source: The Hacker News (India orders messaging apps to work only with active SIM cards, opens in a new tab), Dec 2025, press report; Angel One (DoT extends SIM-binding deadline for WhatsApp, Telegram and Signal till year end, opens in a new tab), 2026, press report; NPCI (UPI user onboarding: product overview, opens in a new tab), as of Oct 2026
Banks are asked to adopt the Reserve Bank Innovation Hub’s mule-detection model, and the I4C Suspect Registry will feed it. An initiative banks are adopting, not a direction.
Calls for: Mule detection.
Source: Outlook Business (Finance Ministry asks banks to use MuleHunter.AI to check digital fraud, opens in a new tab), Dec 2024, press report
The burden of proving customer liability lies with the bank. The customer carries zero liability where the bank was at fault, or where a third-party breach is reported within three working days.
Calls for: Bank liability.
Source: RBI (Customer protection: limiting liability of customers in unauthorised electronic banking transactions, opens in a new tab), Jul 2017
UPI onboarding binds the app to the device and needs an active SIM linked to the bank account. A new SIM or phone means binding again.
Calls for: Device and SIM binding.
Source: NPCI (UPI user onboarding: product overview, opens in a new tab), as of Oct 2026
As reported: zero customer liability where the bank was negligent, and compensation for losses of up to ₹50,000 at 85% or ₹25,000, whichever is lower, once per customer, if reported within five days. RBI issued the directions on 24 June 2026. The terms above are as reported by MediaNama and Business Standard, both secondary; check RBI’s text before relying on them.
Calls for: Bank liability.
Source: RBI (Press release: amendment directions on the review of the framework of limiting customer liability in digital transactions, effective 1 January 2027, opens in a new tab), Jun 2026; MediaNama (RBI’s final amendment directions on limiting customer liability in digital transactions, in effect from 2027, opens in a new tab), Jun 2026, press report; Business Standard (RBI issues amendment directions on the framework of limiting customer liability in digital transactions, opens in a new tab), Jun 2026, press report
Floats a one-hour hold on digital payments of ₹10,000 or more, with trusted payees whitelisted, and extra protections for older customers. A proposal, so it does not mark the control map.
Would touch: Cool-off and holds.
Source: The Paypers (RBI proposes transaction delays and senior-citizen protections to combat digital payment fraud, opens in a new tab), Apr 2026, press report
In short
Two rules in force, one applying, one deadline reported and one proposal, in the order they fall.
Three figures from public sources. None is a DeepID figure, and none says what DeepID would have caught.
The customer sends the money from their own phone, so only the session shows the pressure. Each pattern links the use case that walks through it.
Callers posing as police, customs or a regulator keep the customer on a video call and order a transfer to a “safe account”.
Read in the session: An active call through the payment, a shared screen, payee details typed a few characters at a time.
A messaging group shares “stock tips” and a trading app shows profits that cannot be withdrawn. The customer sends rising amounts to payees that keep changing.
Read in the session: A run of new payees in days, amounts rising with each transfer, payees receiving from many unrelated senders.
A caller builds trust over days, then asks for one large payment to someone new while staying on the line.
Read in the session: A large first payment to a new payee during a long call, with the customer’s agreed support needs on file.
Each control the rule map tracks, whether a rule in India calls for it, and the DeepID modules that support it.
| Control | In India | DeepID modules and how they support it |
|---|---|---|
| Bind the customer to the phone | Rule mapped | SIM and device binding, Device intelligenceSIM and device binding at onboarding and re-binding on change, with the number confirmed by the network and device integrity read every session. |
| Move beyond SMS OTP | Rule mapped | Silent network verification, Liveness and face matchOne-tap login that tries the network check, the SIM check and Aadhaar consent before any one-time code, and face checks with injection defence where identity is in doubt. |
| Check risk at every key event | Rule mapped | Device intelligence, Behavioural biometrics, Scam signals, Payee and mule graph, One decision, with reasonsDevice, behaviour, scam and payee signals read at login, new payee and payment, returned as one decision with its reasons. |
| Cool off and hold | Not mapped yet | SIM and device binding, One decision, with reasonsCool-off and hold decisions after a new device, SIM or payee, or when a payment looks coerced, set per market and journey. |
| Find and stop mule accounts | Rule mapped | Payee and mule graphA payee and mule graph across accounts and devices, with recipient risk scored before the payment is sent. |
| The bank pays when controls fail | Rule mapped | One decision, with reasonsDecision logs with their reasons and the message shown to the customer, and versioned policies, as evidence of what the bank did. |
Not mapped yet means no rule is mapped to that control here, not that no rule exists. DeepID supports compliance and never guarantees it, and it claims no regulator approval.
From 1 January 2027, RBI’s amendment directions on customer liability apply. As reported, the customer carries zero liability where the bank was negligent, so the loss can sit with the bank.
RBI (Press release: amendment directions on the review of the framework of limiting customer liability in digital transactions, effective 1 January 2027, opens in a new tab), Jun 2026; MediaNama (RBI’s final amendment directions on limiting customer liability in digital transactions, in effect from 2027, opens in a new tab), Jun 2026, press report
It is a proposal, not a rule. RBI’s April 2026 discussion paper floats a one-hour hold on digital payments of ₹10,000 or more, with trusted payees whitelisted.
A bank that can tell which sessions are at risk can cool off those sessions instead of every payment.
UPI onboarding already binds the app to the device and needs an active SIM linked to the account. DeepID binds the bank’s own app the same way: the SIM in the phone is matched to the registered number at sign-up, and the account is bound to that SIM and device.
When the SIM or the phone changes, the customer is bound again after a fresh check, such as a face match, and new payees and higher limits can cool off for a period the bank’s policy sets.
With the customer’s consent, a live face can be matched to the Aadhaar record at the moments that need it: a new phone, a UPI PIN reset or a large first payment. UIDAI recorded 28.29 crore face authentications in November 2025.
Liveness and injection checks run on the capture first, so a replayed or generated face is caught before the match.
No integration is claimed. DeepID’s payee and mule signals reach the bank’s FRM beside MuleHunter.AI alerts, and the bank’s team decides on both.
An integration is named on this site only once it is signed.
Sources for these answers: The Paypers (RBI proposes transaction delays and senior-citizen protections to combat digital payment fraud, opens in a new tab), Apr 2026, press report; NPCI (UPI user onboarding: product overview, opens in a new tab), as of Oct 2026; UIDAI (231 crore Aadhaar authentication transactions in November 2025, opens in a new tab), Dec 2025; Outlook Business (Finance Ministry asks banks to use MuleHunter.AI to check digital fraud, opens in a new tab), Dec 2024, press report.
The attacks whose pages name a rule or advisory in India, each told step by step.
By industry: Banks, Digital banks, Lenders, Payments, Insurance, Capital markets.
We show your fraud, security and engineering leads how DeepID would run your sign-up, login or payment journey, then plan a pilot on your own traffic.