Paying foreign websites by card may need an extra check from 1 October

RBI's directions on authentication for digital payments were issued in September 2025 and most of them took effect on 1 April 2026. One part carried a later date. By 1 October 2026, card issuers must have a mechanism in place to validate non-recurring cross-border card not present transactions, which in plain terms means one-off online payments to overseas merchants, where the merchant or its payment processor asks for authentication.

Card not present simply means the physical card is not involved: an online checkout, an in-app purchase, or a payment on a foreign website. Domestic online card payments in India have needed an extra factor such as an OTP for years. International ones have been less consistent, because whether a check happened depended partly on how the overseas merchant had set things up.

In practice, on some international websites a payment that used to go straight through may now show a verification step from your bank. The directions also expect card issuers to apply risk-based checks to cross-border online card payments more broadly, including recurring ones such as foreign subscriptions.

This is a security change, not a new charge. It does not alter the foreign currency markup your card charges, and it has no effect on payments to Indian merchants.