The National Payments Corporation of India (NPCI), the parent organisation of UPI, launched a host of new facilities on October 7, 2025, aimed at enhancing the user experience. As part of this rollout, NPCI introduced additional authentication methods to increase convenience and security.
New biometric authentication facility
The new authentication method allows Google Pay, PhonePe, Paytm and other UPI apps users to make payments using on-device biometric authentication, such as face recognition and fingerprint scanning, as an alternative to the traditional UPI PIN.
This new facility is currently available for transactions up to Rs 5,000. NPCI plans to review this limit in the future based on performance and user feedback.
The biometric feature is optional; users may continue to use existing payment methods.
Security and app requirements
To maintain a robust and secure system, NPCI has implemented several key requirements for the new feature:
- The facility will not be allowed on rooted or jail-broken devices.
- UPI applications (e.g., Google Pay, PhonePe, Paytm) and PSP Banks must obtain explicit customer consent before enabling biometric authentication and must offer an option to disable the facility at any time.
- A fresh consent must be obtained in each new device before allowing further transactions.
Important instructions for Banks and UPI apps
To ensure secure and compliant use of the new feature, the following rules apply:
- Eligibility Check: UPI apps and banks must check customer eligibility and validate authentication credentials before authorising biometric enablement or PIN Set/Reset.
- Customer Communication: Banks must ensure appropriate customer communication during biometric enablement, disablement, and transaction processing.
- PIN Change Trigger: If a customer changes or resets their UPI PIN, their bank must disable the biometric method for that account across all UPI Applications. Transactions on such accounts will be declined until a fresh consent is captured.
- Inactivity Rule: If no transaction is performed using this method within ninety days, UPI applications and PSP Banks must mark the customer as inactive for the biometric method, requiring a customer confirmation to reactivate it.
ALSO READ: Motorola launches budget-friendly Moto G06 Power in India with 7,000mAh battery
