In India, online digital transaction has become prominent means of financial transaction in everyone's day-to-day life as per reserve bank of India's (RBI) reports. Presently, Indian banks protect users' online transactions with only username and password, CAPTCHA, and dynamic 6 or 8-digit one time passwords (OTPs), which are not very secure. According to literature, this straightforward method of authentication is easily vulnerable to numerous threats. The time offered to enter the OTP with numerical pattern is more than 100 seconds, which is in defiance of RBI guidelines and can be used by fraudsters to commit fraud. In this paper we are suggesting a novel 3-Level authentication which is in-line with RBI authentication guidelines along with the authenticator assurance standards of National Institute of Standards and Technology of the United States and the European regulation for electronic payment services, for securing the users online transactions aided by username and password, OTPs and biometrics. At Level-3 user is verified with biometrics or by OTP. For biometric authentication, we have chosen facial trait, a hybrid algorithm for face detection and recognition is designed, implemented and tested on a standard dataset of VTU-BEC-DB. Suitable OTP and time constraints were identified with the implementation of proposed algorithm being tested by conducting series of trials involving 200 participants with age group of 22 to 55 years. Based on online-survey, we are suggesting for the use of fall-back authentication technique powered by security question, incase the authentication is only on the basis of OTP. We have achieved 98.20% recognition success rate for facial recognition. The significant time to enter dynamic 6 digit OTP and dynamic 8 character alpha-numeric OTP with time limits of 45 and 60 at Level 2 and 3 is 33.821.10 and 45.310.92, respectively.