In order to boost online cashless payments using credit and debit cards, the Reserve Bank of India (RBI) has relaxed norms for additional factor of authentication (AFA) requirement for transactions up to Rs 2,000 for online CNP (card not present) transactions. RBI relaxed two-factor authentication for online payments below Rs 2,000 and stated that only authorised card networks shall provide such payment authentication solutions with participation of card issuing and acquiring banks.
As per the latest circular from RBI, an alternate solution, provided by authorised card networks is expected to meet the objective of customer convenience with sufficient security for low value transactions. In this model, the card-issuing banks will offer the payment authentication solutions of the respective card networks to their customers on an optional basis.
Customers opting for this facility will go through a one-time registration process requiring entry of card details and AFA by the issuing bank. Thereafter, the registered customers will not be required to re-enter the card details for every transaction at merchant locations that offer this solution and thereby save time and effort. In this model, the card details already registered would be the first factor while the credentials used to login to the solution (as confirmed by the card network providing the solution) would be the additional factor of authentication.
Further, in the interest of customer awareness and protection, RBI said that the banks and authorized card networks offering such solutions will bear the full liability in the event of any security breach or compromise in the authorized card network. It added that banks and card networks are free to facilitate their customers to set lower per transaction limits.