New 2FA Security Rules: How Online Credit Card Payments Are Changing

India already runs one of the stricter two-factor authentication regimes for card payments in the world, and the rules keep getting tighter rather than looser. If your card's OTP flow has started behaving differently at checkout — extra device verification, tokenization prompts you didn't see before — it's not a glitch, it's policy catching up with fraud patterns.

What 2FA already meant

Every online credit card transaction above a small threshold has long required a second factor beyond the card number and CVV — almost always an OTP sent to your registered mobile number, sometimes a card PIN or net banking login instead. This single rule is why Indian cardholders see far less card-present online fraud than markets where a stolen card number alone is enough to transact.

What's tightening now

The newer layer is tokenization combined with device binding — card networks increasingly replace your actual card number with a token tied to a specific merchant and device, so a saved card on one phone can't be silently reused from another. Recurring payments and auto-debits also now require an e-mandate confirmation step the first time you set one up, closing a gap where subscriptions used to renew without any real-time authentication at all. None of this replaces the OTP; it adds verification around what happens before and after it.

What this means at checkout

Expect slightly more friction the first time you use a card on a new device or set up a new recurring payment, and expect that friction to disappear on repeat transactions once the device and merchant are verified. If an OTP consistently fails to arrive, check that your registered mobile number is current with your issuer before assuming it's a system problem — a stale number is still the most common reason 2FA breaks down for cardholders.

Where to go from here

For the broader set of fraud protections built into your card, see credit card fraud protection tips. If you're comparing how issuers handle this differently, SBI credit cards guide covers one major issuer's security setup in detail.