The deadline has passed. On 1 October 2026, banks and other card issuers in India were due to have a new safety check ready for international card payments, under a rule set by the Reserve Bank of India (RBI), the country’s central bank. It covers online purchases made on overseas websites with an Indian-issued card. As of 13 October, we found no RBI statement or major-outlet report of an extension or a rollout failure, so the date stands as originally written.
What the RBI Ordered Card Issuers to Do
The rule and its deadline
The rule sits inside the RBI’s Authentication Mechanisms for Digital Payment Transactions Directions, 2025 (RBI/2025-26/79), issued on 25 September 2025. It targets card-not-present (CNP) transactions, which are payments made without the physical card, such as online shopping. By 1 October 2026, issuers had to be able to validate an additional factor of authentication (AFA) on non-recurring cross-border CNP payments whenever the overseas merchant or its bank, called the acquirer, requests it.
What else issuers had to set up
The Directions also require issuers to have a risk-based mechanism for handling all cross-border CNP transactions. Issuers also had to register their Bank Identification Numbers (BINs) with the card networks so that overseas requests can reach them.
Not Every Foreign Purchase Will Trigger a Code
When the check is mandatory
Headlines suggesting every overseas purchase now needs a code overstate the rule. The RBI ties the mandatory check to a request raised by the overseas merchant or acquirer, so the same card may behave differently from one foreign site to another.
When your bank may add more
The RBI’s framework lets issuers add risk-based checks beyond the minimum two factors, depending on how risky a transaction looks. Business Standard’s report on the rules lists transaction location, device attributes, spending behaviour and past transaction history as inputs issuers can use. The RBI has also said the framework does not scrap text-message one-time passwords (OTPs), although other factors, including biometrics, can be used.
Why the Regulator Wanted This
From draft to final rule
The RBI published draft directions on AFA for cross-border card-not-present transactions on 7 February 2025 (RBI press release 2024-2025/2114: https://www.rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx?prid=59712). The press release says the draft followed the RBI’s Statement on Developmental and Regulatory Policies of the same date. As Business Standard reported that day, the RBI said extra authentication had made digital payments safer and given customers the confidence to use them. It wanted a similar level of safety for online international transactions made with Indian cards. The final Directions came on 25 September 2025 (RBI press release 2025-2026/1165: https://www.rbi.org.in/scripts/BS_PressReleaseDisplay.aspx?prid=61282).
Domestic rules came first
The final Directions had to be complied with from 1 April 2026. For domestic digital payments they require two distinct authentication factors, with at least one that is dynamic, meaning unique to each transaction. The foreign-payment part was given a later date, 1 October 2026.
Who Pays if Something Goes Wrong
The bank-liability rule is a domestic one
The Directions say that if a loss arises from a transaction processed without complying with them, the issuer must compensate the customer in full. That clause sits in the domestic part of the text. The Directions also state that their domestic provisions do not apply to cross-border digital payments. We therefore found no RBI text confirming that the same automatic full compensation covers a foreign online purchase. If you lose money on an overseas payment you did not make, report it to your bank at once and ask in writing how it will handle the dispute.
Check your card settings first
Under an earlier RBI circular on card security (RBI/2019-20/142, 15 January 2020, in force from 16 March 2020), issuers must give cardholders a facility to switch on online (card-not-present), international and contactless use. Existing cards never used for those purposes had to be disabled for them. The circular is not mandatory for prepaid gift cards or cards used at mass transit systems. In practice, you may need to enable international and online use in your banking app before an overseas purchase works. If a foreign checkout shows a bank prompt, enter a code only on a payment you started yourself.
Our Reading: What Could Happen Next
This section is our own analysis, not a confirmed fact. Because the check applies when a merchant asks or when risk is flagged, shoppers may see uneven results, with a prompt on one foreign site and none on another. Banks that must run a risk-based mechanism on all cross-border CNP payments may flag more unusual purchases. That could mean more declined or abandoned payments until habits settle. More prompts could also give scammers room to imitate bank messages, so checking where a code request came from matters. We found no public data on how many issuers met the deadline, so any claim of a smooth or troubled rollout is premature.
