How banks plan to take on card fraudsters

New guidelines by RBI on card usage will make it difficult for swindlers to dupe cardholders, but customers say security has come at the cost of convenience.

Srishti Chakrabarti, a school teacher in Bangalore, was alarmed when she received a transaction alert on her debit card early one morning. Her card was used in a merchant outlet in north Mexico and a large sum of money was debited from her savings account. Chakrabarti had never travelled outside Asia. 

“My bank statement reflects that it is a POS (point-of-sale) transaction, which means that a forged card has been swiped there (in Mexico), whereas the original and authentic debit card is in my possession in Bangalore,” she complained on the government's Grahak Seva website.

After she persisted with her complaint, the bank admitted that she was a victim of a skimming attack and her card information was stolen. The bank refunded her money. But there are many who have not been so fortunate when their cards were misused.

The multiplicity of frauds involving debit and credit cards has prompted the Reserve Bank of India (RBI) to introduce a set of risk mitigation measures for electronic transactions.

...

“With cyber-attacks becoming more unpredictable and electronic payment systems becoming vulnerable to new types of misuse, it is imperative that banks introduce certain minimum checks and balances to minimise the impact of such attacks,” the banking regulator said in a notification on February 28, 2013. 

While the steps are intended to protect cardholders from swindlers, the risk of fraud remains for customers who are not careful in using plastic money. The new norms, some fear, may also encourage customers to transact more in cash despite banks’ efforts to popularise the use of cards.

To provide an additional layer of security, cardholders are now required to key in their personal identification numbers (PIN) while using debit cards in retail outlets like departmental stores, restaurants and fuel stations.

It appears that many are actually reluctant to punch in their PINs in crowded shops. They prefer to pay in cash instead.

...

There have been a few instances where cardholders were asked to share the PIN with the shopkeeper instead of typing it into the POS machine. Rishita Dutta (name changed), a Kolkata resident, was dining with her friends at a city restaurant last week.

“When I took out my debit card, the waiter asked me for the PIN. I was not comfortable in sharing my PIN with a stranger. The restaurant did not have a portable POS device and I was escorted to the counter to make the payment. It was an awkward situation as the waiter appeared offended and kept proclaiming his honesty. In future, I will probably pay cash to avoid such a situation,” Dutta says.

There’s nothing wrong with paying in cash, except it is cumbersome and could lead to a decline in sales for retailers in large cities.

Settling into a new way of  life

But most bankers feel that these are stray events. “These changes are for the better. Teething problems crop up whenever a new process or system gets introduced. I believe it will be a matter of only three or four months before the issues are resolved. It is just a question of merchants as well as consumers getting used to this new way of life,” Kusal Roy, general manager and head of payments and unsecured loans at ICICI Bank, says.

The limited supply of portable POS machines, especially in restaurants, is probably an issue that needs to be resolved. Customers are not always keen to walk up to the counter to make the payment.

...

Bankers say that non-portable POS devices are more popular with merchants because they cost less, half the price of portable machines in some cases. POS devices are generally priced between Rs 15,000 and  Rs 40,000 depending on the brand, features and portability.

Lenders explain that there is no regulatory mandate on merchant establishments in choosing the type of POS device. Hence, the inexpensive ones are preferred by most.

There are two types of fees that retailers pay for use of POS machines at their outlets. If transaction volumes are low, then the retailer is asked to pay a monthly rental to the bank setting up the POS device.

In addition, the retailer also pays a fixed percentage-based fee, known as merchant discount rate, for facilitating electronic transactions at their stores. This fee is shared by the bank providing the POS machine, the card issuer and the company offering the payment platform.

...

According to RBI data, there were 965,910 online POS machines in the country at the end of August, 2013. But customers complain that many of them are not functioning properly and transaction requests are often declined despite entering in the correct PIN.

Bankers admit that such instances occasionally crop up but assure that the issues are now being resolved.

“Initially, there was a dip of a few percentage points in our authorisation rate. It came down from 96 per cent to 92 per cent between July and September. But now it has started improving again. These are temporary issues. When ATM cards were first introduced it took time to gain traction. Similarly, the new measures will take time to gain acceptance but the steps will help protect the entire ecosystem of cardholders, banks and merchants,” says Pallav Mohapatra, chief executive of SBI Cards, a joint venture between State Bank of India (SBI) and GE Capital.

Keeping the cards local

RBI has also directed lenders to issue all debit and credit cards only for domestic usage unless international usage is specifically sought by customers.

In addition, banks need to ensure that cards allowing international usage are enabled for EMV chips and PIN.

All magnetic strip cards that have been used overseas at least once will have to be converted into EMV chip cards as the latter offer better security. Studies have shown that it is almost impossible for fraudsters to decode EMV chip cards and hence cardholders’ confidential information stay protected.

...

The initial deadline for replacement, June 30, 2013, has already been missed by most banks. While bankers claim that a majority of magnetic strip cards used overseas have now been replaced, they agree that the entire re-carding process is yet to be completed.

Industry analysts estimates that roughly 2 per cent of the 362 million debit cards and one-sixth of the 18.5 million credit cards in India have been used overseas.

The replacement process has also led to an increase in the cost of operations for banks. A magnetic stripe card generally costs Rs 30-50, while a chip-based card can cost more than Rs 150. Banks will also have to incur expenses for delivering these new cards to their customers.

Since, replacement is mandated by RBI, banks cannot recover the additional cost from the cardholders. However, some bankers feel that the impact of cost on their margin could be reduced by increasing the annual fees and usage charges on cards. RBI has also advised banks to put a cap on the international usage on all active magnetic stripe cards to lower the risk of cyber-attacks and misuse.

...

The overseas spend limit will be a subset of the customers' overall credit limit. In other words, the international spend limit will be less than or equal to the overall credit limit of cardholders.

While customers are allowed to revise - increase or decrease - the international usage limit by contacting their respective banks, some of them blame lenders for not explaining it to them unambiguously. For instance, a customer of a large private bank recently received a message informing her that she would not be able to spend more than Rs 10,000 a day overseas on her credit card.

“It works out to less than $200 a day. With this kind of limit, I would not be able to stay in a proper hotel when I would travel overseas. Later I was informed that I could increase this limit. It is really confusing and I cannot understand the need for an overseas spending limit if I am allowed to increase it,” she says.

Bankers believe that it is only a matter of a few months before customers realise the benefits of these new steps as the measures will ensure better security for cardholders.

“There are initial hiccups with every new system. I am quite confident that things will stabilise in the next few months. The measures are going to enhance security of cardholders manifold,” Prashant Joshi, managing director and head of private and business clients at Deutsche Bank in India, says.