The Reserve Bank of India has consolidated cybersecurity requirements for non-bank payment operators into a single set of directions. The rules cover organisations that operate payment systems without being banks, including payment aggregators, prepaid wallet issuers and card networks.
The directions were issued on November 5 and explained publicly on November 9. They bring together earlier requirements on cybersecurity, ATM switch providers and annual system audits.
For users, the rules include safeguards intended to make suspicious payment activity easier to identify and respond to. Some requirements apply to larger operators immediately, while smaller payment companies have until April 1, 2028, to comply.
A cooling period after contact changes
One rule requires a minimum 12-hour cooling period before online payments are allowed after a user changes the mobile number or email address linked to a payment instrument.
The pause is intended to reduce the risk that a fraudster who takes control of an account can quickly change its contact details and move money. It may also affect legitimate users who update their information, so payment providers will need to make the timing clear.
The directions also require payment apps to connect accounts to a user’s phone and SIM card. If an app is unused for longer than a specified period, the user may need to complete device binding again.
Controls for remote-access apps
Payment apps must detect remote-access applications “to the extent possible” and block access to the payment app while remote access is active. These tools can let another person view or control a device, which can be exploited in scams.
The rule does not mean every remote-access tool is being banned from phones. It concerns access to payment apps during an active remote session, with detection and blocking requirements placed on payment operators.
That may occasionally interrupt a legitimate support session. The aim is to reduce the chance that a scammer can guide a user through a payment while controlling or observing the device.
Clearer alerts and fraud reporting
Payment apps and websites must provide a way for users to mark a transaction as fraudulent and notify the payment issuer. Transaction alerts should identify the merchant and amount, rather than showing only a payment gateway or aggregator.
For fund transfers, alerts should show the amount debited and the beneficiary name recorded by the receiving bank. Account and card numbers should be masked where possible.
The directions also call for login protections, including logging users out after inactivity and notifying them about failed login attempts. Multi-factor authentication is required for electronic debits, with specified exceptions.
Who must comply
The updated directions consolidate cybersecurity rules for non-bank payment system operators. They also incorporate provisions about annual system audits and security controls for third-party ATM switch providers.
Large and medium operators must comply immediately under the new direction, while small operators have until April 1, 2028. The specific category of an operator determines its timeline.
The RBI’s stated aim is to provide a single reference point. Consolidation can make rules easier to locate, but customers will experience them through the individual apps and services they use.
What users should expect
Users may see additional checks after changing a phone number, renewed device verification after long periods of inactivity, or an inability to open a payment app during a remote-access session.
They should also receive more specific transaction alerts and have a clearer route to flag suspected fraud. These measures can support safer payments, but they do not eliminate all fraud risks.
The practical effect will depend on how each payment provider implements the requirements and explains them to customers. The rules place new responsibilities on operators while giving users more security prompts and reporting options.