You may have seen a new prompt at checkout recently: instead of waiting for an OTP, your phone asks for your fingerprint or face to approve a card payment. That is a payment passkey. Visa launched one in India in July 2026, RuPay cards started getting them in September, and new RBI rules are pushing banks in this direction. Here is how passkeys work, why they are harder for scammers to abuse than OTPs, and the few things you still need to get right.
Why OTPs are being replaced
The SMS OTP has one big weakness: it is a code you can read out. Many frauds that involve an OTP do not break any technology. They persuade you to share the code with a "bank official", a "delivery agent" or a "KYC team".
The RBI has changed the rules around this. Its Authentication Mechanisms for Digital Payment Transactions Directions, 2025, issued on 25 September 2025 and in force since 1 April 2026, require at least two factors for domestic digital payments, with at least one "dynamic and unique to each transaction", according to Moneylife's summary. They also encourage alternatives to SMS OTP, such as device-based biometrics.
Two other details in those rules are worth knowing:
From 1 October 2026, card issuers must also validate non-recurring cross-border card-not-present transactions, meaning online purchases from foreign websites.
If you lose money because an issuer did not follow the directions, the issuer must "compensate the customer in full, without demur".
How a payment passkey works
A passkey is a digital key created on your phone and tied to your card. Here is the sequence, in plain terms.
Setting it up
The first time you see the option at checkout, you register the passkey. For RuPay cards on Zeta's platform, the September 2026 launch announcement describes this as a single OTP confirmation during registration. After that, the passkey lives on your device.
Paying with it
Next time, you approve the payment with whatever unlocks your phone: fingerprint, face, PIN or pattern. Visa's announcement says its Payment Passkey is built on FIDO standards and uses tokenisation, so your actual card number is not what travels during the payment.
Why a scammer cannot simply ask for it
There is no code to read out. The approval happens on your device, by your finger or face, for that specific payment. A fraudster on the phone cannot ask you to "share the passkey" the way they ask for an OTP. That is the main safety gain.
Where it works today
Visa Payment Passkey: launched on 2 July 2026 with IDFC FIRST Bank as the first issuer. Merchants at launch included Myntra, Paytm, MakeMyTrip, Tata Starbucks, Reliance Digital and EatSure, with payment partners such as Juspay, Razorpay, PayU and BillDesk. As Business Today noted, it was initially available to select users.
RuPay: on 11 September 2026, Zeta went live with passkeys for Pluxee RuPay prepaid cardholders, and said it was expanding to other RuPay issuers. It reported authentication taking about 5 to 7 seconds, against 15 to 25 seconds for OTP flows.
Expect more banks and merchants to add it over the coming months. If you do not see the option yet, that is normal.
Is it safe? Yes, with three conditions
Passkeys remove the most common trick, sharing an OTP. They move the trust to your phone. So your phone's security now matters more.
Your screen lock is now a payment key. If your phone can be unlocked with a PIN, that PIN can approve payments too. Use a six-digit PIN or longer, never 1234 or your birth year, and do not share it with anyone, including family members who "just need to check something".
Do not register a passkey on someone else's device. If a helpful stranger or a shop assistant offers to set up "faster payments" on their phone for your card, refuse.
A passkey does not stop you approving a bad payment. It verifies that you approved it, not that the shop is real. Fake shopping sites still exist. Check the merchant before you touch the fingerprint sensor.
Do this today
Check your phone's lock settings. Turn on biometrics and set a strong PIN.
When a trusted app or bank offers a payment passkey at checkout, it is reasonable to accept it. Read the prompt: it should come from your bank or card network, inside the app or site you are paying on.
Keep SMS and email alerts on for every card transaction. Passkeys change how you approve payments, not how you monitor them.
If you shop from foreign websites, expect extra verification on those payments from 1 October 2026 under the RBI rules. That is a feature, not a fault.
If your phone is lost or stolen
Block your cards through your bank's app from another device, or call the bank's helpline.
Use your phone maker's "find my device" service to lock or erase the phone.
If money has already gone, call the National Cyber Crime Helpline on 1930 and report it to your bank in writing straight away.
The short version: a payment passkey is safer than an OTP because there is nothing to share. Protect the phone that holds it, check who you are paying, and you will have removed the most common way people get cheated online.
