The Unified Payments Interface (UPI) ecosystem in India is being upgraded to allow biometric authentication for transactions of up to ₹5,000. Users can now authorize payments using fingerprint or facial recognition on their devices, providing a faster and more convenient alternative to the traditional UPI PIN.
Image created via Sora
This change follows the Reserve Bank of India (RBI)’s publication of the “Authentication Mechanisms for Digital Payment Transactions” Directions, 2025, which come into effect on April 1, 2026. The guidelines apply to all Payment System Providers (PSPs) and participants, including banks and non-bank entities, and require that all digital payment transactions employ two-factor authentication (2FA). While PIN-based authentication remains valid, the directions explicitly permit modern alternatives such as biometric verification and hardware-based tokens, in line with global best practices for secure payments.
What the Update Means for Users
Under the new framework, users making UPI payments up to ₹5,000 can opt to use device-based biometrics instead of manually entering their PIN. The authentication process leverages secure modules on mobile devices to verify user identity, reducing friction in small-value transactions. Transactions above ₹5,000 continue to require the standard UPI PIN, ensuring stronger security for higher-value payments.
The feature is optional; users who prefer to continue with traditional PIN verification may do so. Major UPI apps, including PhonePe and Google Pay, have begun rolling out the biometric option on Android devices, with broader adoption across other platforms expected throughout 2026. Lalitha Nataraj, CEO of NPCI BHIM, the umbrella organization behind India’s retail payments infrastructure, including UPI, in her communication with ETBFSI, also said that BHIM payment app will be rolling out the biometric authentication option for UPI transactions in the nearest future.
Security and Convenience
The adoption of biometric authentication addresses both security concerns and user convenience. PINs and SMS-based OTPs, while widely used, remain susceptible to phishing attacks and SIM swap fraud. Biometric verification adds an additional layer of security while streamlining the payment process, particularly for frequent, low-value transactions.
Eligible payment apps collect biometric data directly from users’ devices during authentication for UPI transactions. Biometric data is not stored in widely available databases. It remains device-bound and non-shareable, meaning that the captured fingerprint or face scan is matched locally against a secure, encrypted biometric template previously stored on the user’s own smartphone hardware.
Only a yes/no match result is generated and sent to payment app servers or NPCI’s UPI system to authorize transactions up to ₹5,000, aligning with RBI/NPCI rules for low-value payments. This device-bound approach eliminates risks of database breaches, unlike shared PINs.
The RBI emphasizes that risk-based authentication can be applied to transactions, allowing PSPs to implement multiple verification methods appropriate to the payment value and risk profile. By enabling biometrics for small-value transactions, the RBI aims to encourage secure and user-friendly digital payments across India.
Considering all the benefits, it is no wonder that the feature, though being optional, sees a wide customer adoption. Amazon Pay, which was one of the pioneers in UPI biometric authentication adoption, claimed that about 90% of users choose the biometric option, like fingerprint or face scan, over PIN if available for eligible transactions.
Implementation Across the Ecosystem
UPI providers have begun integrating biometric authentication into their apps, allowing customers to enable fingerprint or face recognition for eligible payments. This initiative aligns with the RBI’s broader digital payments strategy, which emphasizes secure, accessible, and technology-driven authentication methods.
The implementation of UPI is one of the most successful nationwide instant payment system solutions in the world. UPI processes over 680 million transactions per day, so that its monthly payment volume can reach more than ₹26 trillion (approximately $290 billion USD) per NPCI statistics. Enhancing it with biometrics as a frictionless extra security measure boosts UPI industry position as it expands into agentic payment and cross-border use cases.
In conclusion, the rollout of biometric authentication for UPI payments up to ₹5,000 represents a significant step in India’s digital payment landscape. Supported by the RBI’s 2025 authentication directions, this initiative enhances user convenience while maintaining robust security standards, reflecting a growing global trend toward flexible and secure authentication mechanisms in real-time payment systems.
Read more:
