Zeta enables OTP-free authentication for Pluxee RuPay prepaid cardholders to authenticate online transactions using device-bound passkeys as India moves towards stronger authentication methods beyond OTPs
India - 11 September 2026: Zeta, a global provider of banking technology platforms and solutions, today announced the launch of passkey-based authentication for RuPay card payments with Pluxee, bringing the capability live for its RuPay Prepaid cardholders. Enabled on the RuPay network by NPCI, the new capability allows eligible online card transactions to be authenticated using a passkey secured on the cardholder’s device, replacing SMS one-time passwords (OTPs) after a one-time registration.
Passkeys already secure digital identities and online accounts globally and are increasingly being adopted for payment authentication. Their introduction into the RuPay card-payment ecosystem marks an important shift from authentication based on credentials delivered over SMS towards cryptographic, device-bound authentication.
The development comes as the Reserve Bank of India pushes the payments ecosystem towards stronger and more resilient authentication mechanisms beyond conventional OTPs, against the backdrop of rising digital-payment fraud. RBI’s revised authentication framework provides greater flexibility in the authentication factors that can be used, creating room for technologies such as passkeys that can strengthen security while reducing dependence on credentials susceptible to phishing and social engineering.
For consumers, passkeys provide stronger, phishing-resistant authentication with significantly fewer steps at checkout. Once registered, there is no OTP to wait for, retrieve or enter. Instead, the cardholder authenticates using a passkey secured on their device, authorised through a fingerprint, facial recognition or device credential such as a PIN. Early observations from Zeta’s implementation show that passkey authentication typically completes in approximately 5-7 seconds, compared with approximately 15-25 seconds for a conventional OTP flow, reducing authentication time by around 70%. Passkey registration itself typically takes approximately 7-8 seconds, with Zeta observing completion rates of approximately 99% in its implementation.
For merchants, stronger authentication comes with substantially less checkout friction. Faster authentication and fewer steps can reduce authentication-related drop-offs and improve payment completion rates, with the potential to increase conversion. Because passkeys use cryptographic credentials rather than credentials that can be disclosed or phished, they can also reduce exposure to certain forms of card-not-present (CNP) fraud and potentially lower associated fraud losses and chargebacks.
Zeta has implemented the end-to-end passkey authentication journey for Pluxee on the RuPay network, from registration and credential management through authentication orchestration and transaction completion:
- One-time Registration: At checkout, a cardholder is offered the option to register a passkey. After verification on the device, a single OTP confirms both the registration and the underlying transaction. Once registered, the passkey can be used for subsequent eligible transactions without requiring another SMS OTP.
- Subsequent authentication: On subsequent purchases, the cardholder simply completes a biometric check- Face ID, fingerprint, or PIN, and the transaction is authenticated instantly, with no OTP at all.
A shift in how digital payments are authenticated
The significance of passkeys goes beyond removing an OTP from checkout. They represent a shift from authentication that relies substantially on credentials communicated to customers towards authentication based on cryptographic trust anchored to trusted devices and authenticators.
That shift becomes increasingly important as the scale of digital payments grows and fraud techniques become more sophisticated.
Digital-payment fraud in India crossed ₹21,367 crore in FY2025, more than five times the previous year, while UPI fraud cases rose 85% year-on-year, according to RBI data. At the same time, RuPay’s role in India’s card ecosystem has expanded significantly. UPI-linked RuPay credit cards now account for nearly 38% of credit card payments in India by volume, up from 10% two years ago , while RuPay's overall credit card market share has climbed from 3% to 16% over the same period. This growth coincides with the RBI's two-factor authentication mandate, in effect since April 1, 2026, pushing the industry beyond SMS OTPs toward dynamic, device-bound factors.
Against this backdrop, authentication needs to evolve alongside the payment ecosystem: becoming harder to compromise without introducing greater friction into increasingly frequent digital transactions.
“The RBI’s push for stronger authentication mechanisms beyond OTPs, particularly in the wake of rising digital-payment fraud, is an important inflection point for the industry. The larger shift underway is from authentication based on credentials that can be intercepted or socially engineered to cryptographic trust that can be bound to a device, an identity, and ultimately the context of a transaction.
“Passkeys are an important step in that direction. Over time, we expect authentication to become increasingly invisible, contextual and risk-aware, with stronger assurance built into the transaction rather than added as friction around it. What we are bringing live with Pluxee on RuPay is an early manifestation of how we believe digital-payment authentication will evolve.” said Ramki Gaddipati, Co-founder, APAC CEO & Global CTO of Zeta.
For Pluxee, the launch extends stronger authentication directly into the everyday payment experience of its RuPay Prepaid cardholders.
"Our cardholders use their Pluxee cards for everyday purchases, making a seamless and secure payment experience a priority for us. Passkey authentication is a meaningful step towards making digital payments simpler and faster, while maintaining strong security. We are pleased to bring this capability to our RuPay cardholders in partnership with Zeta and NPCI," said Anish Sarkar, Managing Director Pluxee India and Director - India/ Philippines/ Indonesia Cluster.
Zeta is also working with other RuPay issuers to extend passkey-based authentication to a broader base of cardholders.
About Zeta:
Zeta is a global provider of technology platforms and solutions to banks and financial institutions. Its cloud-native and fully API-enabled platform supports card processing, issuing, lending, core banking, fraud management, loyalty programs, digital banking apps, and more. With over 1,700 employees globally, Zeta empowers financial institutions to innovate and rapidly launch compliant financial products. Globally, customers have issued over 25M cards using Zeta’s platform. For more information, visit www.zeta.tech or follow us on LinkedIn, YouTube, and X.
Rate us on G2
