Reserve Bank of India to relax 2-factor authentication norms on certain conditions

The Reserve Bank of India on Friday, amid increasing demand for making electronic payments easier, said it is willing to relax the norms only for 'card present' transactions where near-field communication (NFC) technology is used.

RBI said the ATM transactions where the card is not present will continue to require the additional factor of authentication, a PIN or one-time password.

"It has been decided to relax the extant instructions relating to the need for additional factor of authentication requirements for small value card present transactions only using contact-less card payments using NFC," the central bank said in the draft circular late on Friday evening.

The RBI has set a limit of Rs 2,000 per transaction even for contact-less cards, saying that it arrived at this conclusion after examining the trade-off between security and convenience.

The two-factor authentication issue came to light after the Reserve Bank discovered that the US-based taxi service provider Uber was circumventing this norm. This led to the central bank in August 2014 asking the company to comply with its norms by October 2014 or else shut shop. Uber fell in line and complied with the norms.

At present, a customer has to key-in the personal identification number (PIN) for authenticating every transaction. If the draft circular gets implemented, customers using contact-less cards will not have to key in the PIN for transactions worth up to Rs 2,000.

The RBI has advised banks to explain to customers the NFC technology, its use, risks and also the maximum liability devolving on the customer, and also to put in place a robust mechanism to report of loss or stealing of cards.

At present, only ICICI Bank has a contactless card offering, while industry sources say the State Bank of India (SBI), which is the country's largest lender, is also mulling the launch of such a card.

It can be noted that various e-commerce firms have been pitching for doing away with the two-factor authentication for small value transactions, and some like online retailer Snapdeal had also requested for the cap to be set at Rs 3,000.