The regulator, in draft guidelines, said that all digital payment transactions, other than card present transactions, will have to ensure that one of the factors of authentication is dynamically created, after the initiation of payment, and is specific to the transaction and cannot be reused. The RBI has prescribed AFA for all digital transactions done using cards, prepaid instruments and mobile banking channels but no specific factor was mandated for authentication, thus the digital payments ecosystem has primarily adopted SMS-based OTP as AFA.
Source link