2FA for Indian brokers: Zerodha, Groww, Fyers, and the SEBI rule

Every trading day in India starts the same way: you log in. Regulations force brokers to log you out at the end of each day, so a daily trader authenticates roughly 250 times a year. For most of the last decade, that second prompt after your password was a six-digit SMS code — or, at some brokers, a question about your date of birth. As of late 2026 it is, in practice, a TOTP code from an authenticator app. A regulator did that, which makes India one of the few markets where the answer to "does my broker have 2FA?" is simply yes, by law.

The rule: SEBI made two-factor login mandatory

The Securities and Exchange Board of India set a hard deadline of September 30, 2022: every demat account holder had to enable two-factor authentication to keep using their account. The requirement covers login to trading platforms and comes out of SEBI's broader push for safer participation by investors — the same framework that put two-factor authentication on mutual fund transactions, implemented for redemptions from June 1, 2022 and later extended to subscriptions by SEBI circular.

The rule's shape matters. Two factors must come from different categories — something you know, something you have, something you are — the same taxonomy explained in our 2FA overview. In practice brokers implemented the second factor as an authenticator-app TOTP, a biometric device lock, or an OTP over SMS and email. The industry did not stop at the minimum. Zerodha's own account of the rollout describes why SMS was the wrong ceiling for brokers specifically: at market open, millions of users log in within minutes, and time-sensitive OTP texts sent through telcos at that scale arrive late or not at all. When a delayed code can stop you from squaring off a position on a volatile day, the channel is not just weak security — it is an operational risk.

So the mandate arrived, and the bigger brokers went further than it required. That is the rare version of this story. Compare the US banking equivalent in our bank and finance 2FA tour, where a decade of regulator guidance still leaves Chase without an authenticator-app option.

The platforms: what each broker offers

Broker	Second factor at login	External TOTP?	Where the setting lives
Zerodha	Kite App Code or external TOTP, SMS/email OTP fallback	Yes, by QR code	Kite, My Profile, Password & Security
Groww	PIN or biometric after sign-in, device OTP at registration	Not offered	My Profile, Settings
Fyers	External TOTP, with SMS/email OTP	Yes, by QR code	App security settings
Upstox	TOTP via authenticator app	Yes, by QR code	App, during setup or API activation

Zerodha Kite

Zerodha has offered external TOTP since 2018, well before the rule — Z-Connect documented the login flow and its Password & Security settings years before the mandate. The path today: log in to Kite, click your client ID, open My Profile, then Password & Security, and enable TOTP. You scan a dynamically generated QR code with any standards-compliant authenticator — Google Authenticator, Microsoft Authenticator, Bitwarden — or copy the secret by hand. From then on, Kite web and mobile prompt for that code at login.

The default alternative is the Kite App Code: when you enter your password on the web, a code that lives a few seconds pops up on your authenticated Kite mobile session, which itself sits behind a mandatory biometric device lock. Zerodha describes the App Code as TOTP internally — same cryptography, integrated into the app. The first login to Kite mobile uses username, password, and an SMS OTP, after which the biometric lock takes over. There is also an SMS and email OTP fallback for users who want neither, which Zerodha's support portal keeps while explaining exactly why it is the weakest of the three.

Groww

Groww implements the rule in its own shape. Per Groww's own security write-up, initial registration is three-factor: sign-in via Google, Apple, or email, plus an OTP for device registration, plus a PIN or biometric. Every subsequent sign-in is two-factor: the sign-in itself, then the PIN or biometric on the device. The password and PIN live under My Profile, Settings, Change Password/PIN.

What Groww does not advertise is standard external TOTP enrollment. The factor is bound to your devices and biometrics rather than a portable secret you could enroll in any authenticator. That is defensible — a biometric behind a device lock is a strong factor — but it changes the recovery math. No QR code means no way to move the factor to a second device or a printed backup, so a lost phone routes you through Groww's account recovery instead of a re-scan.

Fyers

Fyers supports external TOTP. Enabling 2FA in the app's security settings shows a QR code and secret key that work with Google or Microsoft Authenticator, and the same TOTP credential is what API users supply when generating access tokens — Fyers' own community threads walk through TOTP verification at login and its failure modes. For a discount broker of Fyers' size, the notable part is that TOTP is load-bearing: algorithmic and API-driven traders cannot skip it.

Upstox

Upstox treats TOTP as the standard second factor. Its own materials describe TOTP-based logins using apps like Google Authenticator — 30-second codes, no telco in the loop. Upstox also leans on TOTP hardest for its API: third-party integrations report that login requests are refused outright when TOTP is not enabled on the account, which pushes every serious user through authenticator enrollment.

What the mandate actually changed

The before-picture deserves recording, because its leftovers are still around. The classic Indian broker login was client ID, password, and then a second prompt asking for your date of birth, PAN digits, or a static PIN — all knowledge, no possession, which made it one factor wearing two badges. SMS OTP was the upgrade. What TOTP is covers the mechanism: a shared secret plus the clock, computed on the device, nothing transmitted.

Three things changed when the rule bit. Codes moved from the phone network into authenticators and app-integrated TOTP like the Kite App Code, so a dead zone no longer locks you out at 9:15. Mobile apps gained mandatory device locks — biometric or PIN — so the session itself became a factor. And enrollment stopped being optional, which is the whole difference between a security feature and a security posture: a setting 5 percent of users enable protects 5 percent of users.

The leftovers: credential sharing. Zerodha's security notes list the realistic threats to a broker account, and the top items are users willingly sharing credentials with tip providers who promise to trade on their behalf, users handing over credentials in social-engineering calls, and phishing pages. No factor survives you typing it into the wrong hands.

Practical guidance

• Prefer external TOTP where it is offered. At Zerodha, Fyers, and Upstox, take the QR-code enrollment over the SMS fallback. An authenticator app works offline, in dead zones, and at market open when the SMS gateway is melting.
• Any standard TOTP app works, including browser-based ones. The enrollment is ordinary TOTP — a QR code, a Base32 secret — so the choice of generator is yours: phone apps, or our comparison of the best TOTP apps of 2026. The guest generator on 2FA by DependsiT takes the QR image, the otpauth:// link, or the raw secret directly, computes codes entirely in the page, stores nothing, and clears on reload — useful on a trading desk where the phone stays in a bag.
• Treat the enrollment secret like a key. Screenshot the QR into a synced gallery, or paste the secret into a notes app, and whoever reads that storage later generates your codes forever. Save secrets somewhere encrypted, keep a second copy, and print the recovery options.
• Mind the recovery path. Recovery flows at some brokers still fall back to SMS and personal-data questions — the pre-2022 pattern surviving in the corner where the regulator is not looking. That is where an attacker goes when the front door holds.
• Never share credentials. No broker asks for your password, PIN, or OTP by phone, email, or message. The offer to "manage your account for guaranteed returns" is the threat model, not the mitigation.

Frequently asked questions

Is 2FA mandatory for demat accounts in India?

Yes. SEBI set a September 30, 2022 deadline for every demat account holder to enable two-factor authentication, covering login at brokers and depository participants. The rule requires two factors from different categories, and brokers implemented it as TOTP, biometric device locks, or OTP. Some brokers, including Zerodha, now treat enabling TOTP specifically as mandatory under the exchange regulations that followed.

How do I enable TOTP on Zerodha Kite?

Log in to Kite, click your client ID at the top right, open My Profile, then Password & Security, and enable TOTP. A QR code appears — scan it with any authenticator app, or copy the secret manually — and enter one generated code to confirm. The alternative is the Kite App Code, which pops up on your logged-in Kite mobile session and uses the same TOTP cryptography behind a biometric device lock.

Does Groww support TOTP?

Not in the standard, portable sense. Groww's two-factor implementation is sign-in plus a device PIN or biometric, with a device-registration OTP at first login — factors bound to your hardware rather than a secret you can enroll in any authenticator app. It satisfies the rule and survives SIM swaps, but you cannot back the factor up, move it to a second device, or print it the way you can a TOTP secret.

Can I use Google Authenticator for my broker account?

Yes, wherever the broker offers external TOTP — Zerodha, Fyers, and Upstox all enroll through a standard QR code or secret key that Google Authenticator, Microsoft Authenticator, Bitwarden, or any other standards-compliant generator accepts. The credential is ordinary TOTP, so the generator is interchangeable. If codes are rejected afterward, the usual culprit is device clock drift, covered in our guide to 2FA not working.

What happens if I lose the phone with my broker TOTP?

You re-enroll through the broker's recovery process. At Zerodha, resetting your password and re-enabling external TOTP is the documented path, and authenticator apps can be installed on laptops too, which is one way to avoid the single-device trap. Expect identity verification and a wait — and expect it to be slower than the two minutes the original setup took, which is the argument for a second copy of the secret before you need it.

Two hundred and fifty logins a year is a lot of six-digit codes. The guest generator earns its keep on the days your phone does not.