Beyond OTPs: Why Passkeys Could Make India's Digital Payments Safer

Paying through Unified Payments Interface (UPI), cards and mobile wallets has made shopping easier, especially during the festive season. However, the growing use of digital payments has also given fraudsters more ways to target shoppers. Fake discount offers, bogus shopping websites and messages about pending deliveries or refunds are some of the tricks they use.

McAfee’s 2025 festive research found that nearly one in three Indians had fallen victim to festive scams, while 91 per cent had received suspicious shopping-related messages, including fake refund alerts.

“The trick is often to catch shoppers off guard. A message claiming that a payment has failed, a parcel is stuck or a refund is waiting can look genuine. Clicking on the link may take the customer to a fake payment page where fraudsters try to collect bank details, passwords and OTPs. The losses are not small either. Ministry of Home Affairs data shows that people reported losing around Rs 22,495 crore to cyber fraud through complaints filed in 2025,” says Mehul Mistry, senior vice president-customer success, strategy and growth, Zeta, a banking tech company.

That exposes the weaknesses of OTP-based authentication. SMS-based OTPs travel over mobile networks and can be compromised through SIM-swap fraud, intercepted, shared under deception or entered into fake websites. Repeated reminders to "never share your OTP" place considerable responsibility on customers to identify deception, often while distracted or under pressure.

A passkey is a cryptographic credential created for a specific service and protected by the user's device or supported passkey provider. It is unlocked using a fingerprint, face recognition or device PIN. Unlike an OTP, it does not require customers to receive, read or manually enter a code. Because authentication is cryptographically bound to the genuine service, a lookalike website cannot simply capture and reuse the credential. Built on open FIDO standards, passkeys work across major devices and browsers.

“Stronger security can also be faster. Early implementation observations from Zeta's work with Pluxee on RuPay prepaid card authentication, powered by Zeta Cipher (Customer Identity & Authentication Platform), indicate that passkey authentication can significantly improve the payment experience. Authentication has taken approximately 5–7 seconds, compared with 15–25 seconds for a typical OTP-based flow, while registration completion has been approximately 99 per cent,” says Mistry.

There is an important boundary. Passkeys address credential phishing, but cannot prevent every type of scam. Many digital payment frauds involve customers being manipulated into sharing information or authorising payments themselves. Banks therefore also need real-time transaction monitoring, intelligent risk assessment and timely customer warnings.

Adds Mistry: “This is the direction India’s regulatory framework is moving towards. The RBI’s Authentication Mechanisms for Digital Payment Transactions Directions, 2025, which came into effect on April 1, 2026, provide greater flexibility in adopting alternative authentication factors while retaining the requirement for robust multi-factor authentication.”

Passkey implementations must be designed to meet the applicable two-factor and dynamic-authentication requirements. RBI is also developing the Digital Payments Intelligence Platform (DPIP), envisaged to enable real-time risk intelligence and information sharing across the banking ecosystem. These initiatives are complementary: passkeys can reduce exposure to credential phishing, while context-aware risk engines can identify suspicious transactions and trigger additional checks based on risk.

“Passkey-based authentication deserves a central place in every bank's digital payment modernisation strategy during, ahead of the next festive season. The objective should be to move beyond authentication mechanisms that depend on customers protecting and manually entering secrets, towards credentials designed to resist phishing and impersonation,” adds Mistry.

The next step for the industry is to combine passkeys with intelligent transaction monitoring, shared risk intelligence and customer-controlled safeguards such as transaction limits and kill switches, which RBI is exploring. Together, these measures can create a more resilient digital payments ecosystem, one that protects customers without compromising the speed and convenience that have made digital payments so widely adopted in India.