Ans: All CP and CNP transactions on cards issued in India are secured with AFA. This AFA can be in any form and few commonly used forms are PIN, dynamic one-time password (OTP), static code, etc. The requirement of AFA is not mandatory for transactions where outflow of foreign exchange is contemplated. Similarly, in case of CP transactions (except ATM transactions) using NFC contactless technology, transactions for a maximum value of ₹5,000 per transaction are allowed to be undertaken without AFA requirement, subject to adherence to EMV standards.

Ans: In case of CNP transactions, RBI has mandated providing AFA for domestic transactions. If a transaction has taken place without AFA and the customer has complained that the transaction is not effected by her / him, the issuer bank shall reimburse the loss to the customer without demur. Further, liability of a customer in case of an unauthorised electronic payment transaction is limited as per the provisions of RBI circulars DBR.No.Leg.BC.78/09.07.005/2017-18 dated July 6, 2017, DCBR.BPD.(PCB/RCB).Cir.No.06/12.05.001/2017-18 dated December 14, 2017, and para 17 of Master Directions on PPIs dated August 27, 2021 (updated as on November 12, 2021).