X user questions extra verification after OTP for ₹1.05 lakh credit-card payment; what RBI rules say
A social media post by a credit-card user has raised questions about why a bank may seek additional confirmation for a payment even after the transaction has been authenticated through an OTP.
Sandeep Hegde said on X that he paid ₹1,05,411 towards his HDFC Bank credit-card bill, entered the OTP and received the usual confirmation that the payment had gone through. He said that within minutes, he received multiple calls and WhatsApp messages asking him to confirm the same payment.
Hegde questioned why an additional confirmation was required after OTP authentication and argued that repeated bank messages asking customers to confirm transactions could make genuine alerts look similar to scam messages. Mint has reached out to HDFC Bank for a comment and was awaiting its response at the time of publication.
What does RBI say about OTP authentication?
The Reserve Bank of India (RBI) requires banks to put in place additional authentication or validation for online card-not-present transactions. Its directions also provide for additional authentication based on information that is not visible on the card.
RBI’s digital-payment security framework requires banks to have appropriate security controls for electronic payments. It also provides for risk-based and adaptive authentication, under which the authentication approach can take into account factors such as risk assessment, the customer’s risk profile and behaviour.
The RBI framework, however, does not prescribe that every transaction successfully authenticated through an OTP must be followed by a separate confirmation call or message.
Why can banks carry out additional security checks?
RBI’s digital-payment security framework requires banks to put in place controls to manage risks associated with electronic payments and assess the risks involved in the services they offer.
The framework also permits banks to use risk-based and adaptive authentication, allowing security measures to be applied based on factors such as risk assessment, customer profile and behaviour. This means the security process need not be identical for every transaction.
However, RBI does not prescribe specific circumstances in which a bank must contact a customer again after an OTP-authenticated payment. It also does not require a second confirmation for every transaction that has passed OTP authentication.
In this instance, the reason for the additional calls and WhatsApp messages can only be established from the bank’s explanation. Mint has sought HDFC Bank’s comment on what triggered the additional verification and whether such checks form part of its standard transaction-security process. The bank’s response was awaited at the time of publication.
