For online credit/debit card transactions, which are essentially card-not-present transactions, RBI had mandated a second factor authentication based on information not present on the cards with effect from August, 2009. This measure enhanced the confidence of customers as evidenced by the spurt in online transactions in the recent past.
The second factor of authentication has been mandated for Interactive Voice Response (IVR) transactions from  BIS central bankers’ speeches  7  February 2011 and for the residual transactions ( Mail Order Telephone Order transactions, hotel bookings etc.) with effect from May 2012.