Under the new UPI rules, every transaction must be verified using at least two factors, such as a PIN, OTP, or biometrics.