India’s five-decade-old authentication habit — waiting for a six-digit code on a phone — got its first major structural challenge at the country’s public-sector banks last week, when Visa and Mumbai-based payment processor In-Solutions Global (ISG) jointly activated Visa Payment Passkey (VPP) for cardholders at Union Bank of India, Central Bank of India, Bank of Maharashtra, Indian Overseas Bank, and Indian Bank. The launch, announced at Global Fintech Fest 2026 on September 18 in Mumbai, makes these five government-owned lenders the first public-sector institutions globally to activate phishing-proof payment authentication through a shared issuer-processing platform — skipping the bank-by-bank integration grind that has slowed private-sector rollouts.
That distinction matters because the problem the launch addresses is not a niche security concern. Cybercrime losses in India reached ₹22,845 crore (approximately $2.4 billion USD) in 2024, a 206% increase from the prior year, with more than 22.68 lakh (2.27 million) cybercrime incidents logged through the National Cyber Crime Reporting Portal that year. Authorities were forced to block more than 9.42 lakh SIM cards to curb SIM swap fraud — attacks whose entire purpose is intercepting the OTPs that guard those bank accounts. India also handles roughly 48.5% of global real-time payments, making its authentication infrastructure among the most lucrative targets anywhere in the world.
