Zeta and Pluxee Launch OTP-Free Passkey Authentication for RuPay Card Payments

Zeta and Pluxee have launched passkey-based authentication for RuPay prepaid cardholders in India, marking a significant departure from traditional SMS-based one-time passwords (OTPs). This deployment addresses the Reserve Bank of India’s mandate for more resilient authentication frameworks to combat a sharp rise in digital payment fraud across the country’s expanding financial ecosystem.

What was announced

Zeta has implemented an end-to-end passkey authentication journey for Pluxee on the RuPay network, enabled by the National Payments Corporation of India (NPCI). The system allows cardholders to replace SMS OTPs with cryptographic, device-bound authentication. During a one-time registration at checkout, a cardholder verifies their device, and a single OTP confirms both the registration and the transaction. Subsequent eligible purchases are authenticated instantly via biometrics—such as Face ID or fingerprint—or a device PIN.

The transition to passkeys is driven by a deteriorating security environment; digital payment fraud in India reached ₹21,367 crore in FY2025, a fivefold increase over the previous year, while UPI fraud cases surged by 85%. Simultaneously, RuPay’s market presence has grown, with UPI-linked RuPay credit cards now representing 38% of credit card payment volume in India, up from 10% two years ago. RuPay’s overall credit card market share has also risen from 3% to 16% in that period.

Performance data from Zeta’s implementation indicates that passkey authentication typically completes in 5-7 seconds, a 70% reduction compared to the 15-25 seconds required for conventional OTP flows. Registration completion rates have reached approximately 99%, taking only 7-8 seconds. This efficiency aims to reduce merchant checkout friction and lower the risk of card-not-present (CNP) fraud, which is often facilitated by phishing or social engineering of SMS credentials.

"The RBI’s push for stronger authentication mechanisms beyond OTPs, particularly in the wake of rising digital-payment fraud, is an important inflection point for the industry. The larger shift underway is from authentication based on credentials that can be intercepted or socially engineered to cryptographic trust that can be bound to a device, an identity, and ultimately the context of a transaction."

Ramki Gaddipati, Co-founder, APAC CEO & Global CTO of Zeta.

The companies involved

Zeta is a global provider of banking technology platforms and solutions, specializing in modernizing the tech stack for financial institutions. The company offers a range of products designed to handle credit, debit, and prepaid card processing, as well as core banking and mobile experiences. Zeta has established a significant presence in the Indian market, particularly as banks seek to upgrade their legacy systems to meet new regulatory standards for security and scalability.

Pluxee, formerly part of the Sodexo Group, operates as a global player in employee benefits and engagement. In India, the company provides a variety of digital payment solutions, including the RuPay prepaid cards now utilizing this passkey technology. Pluxee India is led by Managing Director Anish Sarkar. The partnership also involves the National Payments Corporation of India (NPCI), the umbrella organization for operating retail payments and settlement systems in India, which manages the RuPay network and has been instrumental in integrating passkey capabilities into the domestic card ecosystem.

What FF News has reported before

FF News has closely tracked Zeta’s influence on the Indian banking sector and its focus on advanced technology. In September 2026, we reported that 70% of Indian Banks Run AI in Production as Security Concerns Limit Scale: Zeta, highlighting how security and control have become the primary drivers for technological adoption in the region. Additionally, Zeta has been active in the generative AI space, as seen with the February 2025 launch of its customer support agent, detailed in Zeta Launches Selene: Gen AI Customer Support Agent for Banks and Fintechs. These developments underscore Zeta's broader strategy of embedding high-assurance technology into the banking experience.

What this means

The move to passkeys signals the beginning of the end for the SMS OTP in India. While OTPs were once the gold standard for two-factor authentication, the ₹21,367 crore fraud figure proves they are no longer sufficient against modern social engineering. By shifting the "trust anchor" to the physical device through cryptography, Zeta and Pluxee are setting a new baseline for the industry. This puts immediate pressure on competing card networks and issuers to match this level of friction-free security. The 70% reduction in authentication time is a massive win for merchant conversion, but the real test for the sector will be whether this technology can effectively curb the explosive growth of UPI-related fraud.