How to use face and fingerprint for faster UPI payments. 6 key FAQs you should know

The Unified Payments Interface (UPI) is set for a significant upgrade. Users will have the option to approve transactions using fingerprint or facial recognition instead of entering their usual PIN. This aims to make digital payments quicker, more convenient, and more secure for millions of Indians.

"In the current UPI functionalities, one of the factors of authentication is implemented through the UPI PIN for transaction authentication (except UPI Lite and mandate execution) which is set using Aadhaar OTP or Debit Card credentials and Issuer OTP. To enhance customer experience, it has been decided to introduce additional authentication methods.These addi1ional methods are optional for the user, and he/she may continue to use the existing methods," said NPCI in a circular dated 7 October.

So, what is changing for UPI users, how the new process will function, and what to expect. Here's an explainer:

This new feature allows customers to authenticate their UPI payments using their smartphone's built-in security options, such as fingerprint or face unlock, as an alternative to manually entering their UPI PIN.

Customers will have the option to opt in and choose this as their preferred mode of authentication.

NPCI also introduced an Aadhaar-based face authentication to enable biometric authentication for setting or resetting the UPI PIN for Aadhaar-linked accounts.

The biometric data will be tied to the Aadhaar system.

Initially, such transactions will be capped at ₹5,000, and the limit will be reviewed later.

• No need to enter PINs each time.

• No need to remember PINs, especially helpful for people who find PINs hard to use (elderly, rural, low-literacy, etc.

• PINs can easily be compromised. In contrast, biometric traits (like fingerprints or face scans) are, in principle, much harder to steal or replicate, providing a stronger layer of security.

• Adopting biometric authentication could also lead to a reduction in transaction failures that are commonly caused by users entering the wrong PIN or forgetting their PIN entirely.

Switching to biometric authentication is expected to dramatically reduce UPI-related fraud, according to experts. The reason is simple: a PIN can be compromised, but biometric data (such as a fingerprint or face scan) is nearly impossible to steal or duplicate, making biometric-based transactions far more secure.

"The recent announcement that users will soon be able to authenticate digital payments using their fingerprints or facial recognition, replacing PINs for faster and safer transactions on the one hand enhances convenience and inclusion, however, on the other hand it raises huge concerns with respect to privacy and related legal issues therefor it is imperative that the Government bodies and Regulators recognize the need for strong safeguards, accountability, and transparency," said Dheeraj Gupta, Advocate and Managing Partner Peritia Law Chambers.

NPCI has issued strict guidelines for all UPI applications and banks (Issuer and PSPs) to ensure security and consumer protection:

• Apps and banks must obtain clear, explicit consent from the customer before enabling these features. Customers also retain the right to opt out at any time.

• Apps must perform necessary security checks, including restricting usage on rooted or jail-broken devices and validating the device’s biometric enrollment status.

• Issuer banks must verify the customer's eligibility and credentials before authorizing biometric enablement or a PIN Set/Reset.

• If the UPI app performs a "device binding" operation (e.g., after a new login), it must obtain fresh consent from the user before allowing further biometric transactions.

• If a user changes or resets their UPI PIN, Issuer banks must immediately disable the biometric authentication method for that account across all UPI applications until the customer explicitly re-consents.

• UPI applications must perform a key rotation operation within one year of enabling biometrics to maintain security integrity.

• If a customer does not perform a biometric transaction for ninety days, the method will be marked as inactive and must be reactivated only upon customer confirmation.

This development comes after the Reserve Bank of India (RBI) recently allowed the use of alternate authentication methods beyond traditional PINs.