Failure To Provide Fallback Authentication Methods

This failure is now direct liability under RBI Authentication Mechanisms Directions, 2025 effective 1 April 2026. If you only offer one authentication path and it fails, and you have no alternative, any loss is on you.

1. What Does The Failure Mean?

Primary Authentication: OTP SMS to registered mobile.

When it fails: SIM swap, no network, phone lost, abroad, SMS delivery failure, DND, telecom infra failure.

What RBI now mandates:

Every domestic digital payment must be verified using at least two distinct factors, one must be dynamic (generated uniquely for each transaction). Compromise of one factor must not compromise other.

Factors categories:

• Knowledge: Password, PIN, passphrase
• Possession: Card, hardware token, software token, SMS OTP, app push
• Inherence: Fingerprint, Face ID, Aadhaar-based

The Fallback Gap: Most banks implemented ONLY SMS OTP as second factor. No fallback = When SMS fails, customer is locked out OR bank bypasses 2FA to allow transaction = both are violation.

RBI Directions 2025 explicitly says:

• Issuers must guarantee robustness and integrity before deployment
• If any loss arises out of transactions effected without complying with these directions, issuer shall compensate customer for loss in full without demur
• Issuers may apply heightened checks beyond two factors depending on fraud risk - location, device, history - and may use DigiLocker for high-risk confirmation
• Customers must be allowed to select preferred authentication factors

Quote from RBI: "Issuers are required to compensate customers if transactions fail to meet authentication standards"

2. Why No Fallback Is A Systemic Failure

From privacy investigation Fido Canada 2021 - same principle applies to banks:

Despite having established protocols that require employees to authenticate callers using multiple methods, protocols were bypassed by each CSR.

In that case:

• Protocol said: authenticate using DOB + postal code + PIN/Voice ID + out-of-box questions (last bill amount, authorized individuals, last 4 digits of ID)
• If caller fails 3 out-of-box questions, must instruct to present to retail store with govt ID
• In 5 calls reviewed, fraudster provided wrong name, wrong PIN twice, failed Voice ID, yet CSR granted access and even disclosed account number, DOB, address.

Finding: Multiple authentication failures by different CSRs = systemic safeguards issue. Organization in contravention of Principle 4.7 - must protect against unauthorized access. Must consolidate protocols, provide regular refresher training, monitor compliance.

Same applies to banks: If you have only SMS OTP and no fallback like app push, TOTP, hardware token, branch verification, you force staff to bypass.

Second failure example: No effective fallback mechanism if SMS authentication fails. What is next? Knowledge-based authentication? Secure app-based verification? Live agent identity check? In this scenario, only fallback was "call again or go to branch."

That is deficiency.

3. Case Laws

CASE 1: RBI New Framework Liability - 2025 Directions

Rule: From 1 April 2026, all domestic digital payments require 2FA, one factor dynamic. If transaction without compliance causes loss, issuer compensates in full.

Case Reference: Business Standard report - "Every domestic digital payment must be verified using at least two distinct factors... If any loss arises out of transactions effected without complying with these directions, issuer shall compensate customer for loss in full without demur"

Implication for Fallback: If your only dynamic factor is SMS OTP and SMS fails, and you process transaction with only password, you have violated directions. You pay.

CASE 2: Union Bank of India Vs. M/S Vibhav Real Estate - NCDRC R.P. No. 1551/2023 & NCDRC Zero Liability Ruling

Facts: Unauthorized transactions. Bank claimed transactions authenticated using OTP sent to registered mobile, so bank not liable.

Held: NCDRC held bank liable for deficiency. RBI guidelines mandate zero liability for customers if unauthorized transactions occur without their fault and reported within 3 days. Commission noted bank must prove authentication robustness. If OTP is only fallback and telecom infra compromised (SIM swap), customer did nothing wrong, authentication system bypassed.

Principle: Where fraud enabled entirely through telecom infrastructure without cooperation or error by customer, bank must bear liability. Customer did nothing wrong; authentication system was bypassed.

CASE 3: Fido Solutions Inc. - PIPEDA Findings #2021-004, Canada - March 30, 2021

Facts: Fraudsters accessed account 5 times over days in Jan 2019 despite customer adding security PIN and secret questions. Fraudsters accessed name, DOB, postal code, account number, email.

Investigation Finding: CSRs failed to follow authentication protocols - disclosed information that should be used to authenticate. After fraud detection, "flash alert" placed too late.

Held: Failure to adequately safeguard personal information. Multiple failures indicative of systemic safeguards issue. Must ensure account authentication protocols and protocols for flagging accounts at heightened risk are easily accessible, clear, easy to follow, regular refresher training, proactive feedback systems.

This is cited globally for fallback failure - if you don't train staff on fallback (out-of-box questions -> retail store verification), fallback fails.

CASE 4: Vinod Kumar Meena v. State - Madhya Pradesh High Court, Indore Bench

Held: Biometric verification failure cannot be reason to deny person's legal or fundamental rights.

Applied to payments: If Aadhaar biometric or fingerprint fails as fallback, you cannot deny customer access to own funds. You must provide alternative fallback. Denial = violation of rights + deficiency under Consumer Protection Act.

CASE 5: Consumer Commissions - SBI Liability Cases - Bangalore District Commission

Facts: SBI held liable for deficiency for failure to safeguard FD account, unauthorized transactions Rs 25,000.

Principle Extended: Banks can be hauled up for not verifying customer signature - service providers can be held liable under Consumer Protection Act for loss caused due to negligence. Same logic applies to digital authentication - failure to provide robust fallback verification = negligence.

CASE 6: Delhi High Court - Phishing vs Bank Negligence Distinction (May 2025)

Delhi HC held: If fraudulent transaction occurs due to negligence of customer (responding to unverified link), banks not responsible. But if due to failure of authentication architecture (no fallback, bypass), bank responsible. Relies on RBI 2017 circular distinguishing fraud attributable to bank's negligence vs customer's deficiency.

4. What Compliant Fallback Architecture Must Have

Under RBI 2025 Directions:

1. At least 2 fallback options beyond SMS OTP:

• App-based push approval (possession factor - device binding)
• TOTP / Authenticator app (dynamic, offline)
• Hardware token / Card PIN + Biometric
• DigiLocker confirmation for high-risk transactions as suggested by RBI

2. Risk-based step-up:

• Evaluate location, device details, transaction history, usage patterns
• When payment appears unusual, introduce additional security checks beyond standard 2FA

3. Customer choice: Allow customer to select preferred authentication factors that comply with framework

4. Robustness testing: Before deployment, guarantee robustness and integrity

5. Zero Liability compliance: If system fails and you process without 2FA, you reimburse fully

Failure to provide fallback = you are automatically in violation of "compromise of one factor must not compromise other" - because if SMS OTP is only dynamic factor and SMS compromised via SIM swap, you have no security left.