Banking: Fighting frauds

Written by feBureau | Updated: Apr 5 2013, 22:22pm hrs
Rising credit card malpractices have prompted banks to take additional safety measures

With credit card frauds on the rise, banks are working on a technology to embed electronic chip into cards, following which each transaction will have to be authenticated by a personal identification number (PIN) by the user. Currently, over 99% of the total cards issued in the country are magnetic stripe cards, but some banks, such as Citibank, HDFC Bank and State Bank of India, are now issuing Euro Pay MasterCard Visa (EMV) chip cards for customers who are frequent global travellers and have a high credit limit.

There are around 28 crore debit cards and 1.7 crore credit cards in circulation at present. The number of point of sale (PoS) terminals in the country is about 5.6 lakh and there are some 70,000 ATMs. Frauds relating to stolen and counterfeit cards amount to nearly R20 crore. Of late, Indians who have travelled abroad especially to countries like Thailand and Malaysia or some African nations have been victims of credit card fraud. As part of a larger cleaning-up exercise, banks have now become more cautious about issuing new cards and are undertaking rigorous credit checks.

Data from the RBIs Trends and Progress in Banking report show that the total number of outstanding credit cards issued by scheduled public, private and foreign banks in 2011-12 dropped to 17.65 million from 27.55 million during 2007-08.

Private sector banks have been more cautions in issuing new cards and the number of outstanding credit cards has fallen from 13.29 million in 2007-08 to 9.67 million in 2011-12. Interestingly, RBI data also show that outstanding debit cards have increased and transactions through them have outpaced the number of credit card swipes.

To enhance the security of plastic cards, a RBI panel has suggested that an alternative to PIN which is used at ATMs for cash withdrawal could be a biometric verification of the cardholders identity using data from UIDAIs Aadhar.

At present, all transaction data from the PoS or the ATM travels to the host system in clear-text format, except the PIN data. The transaction data travels through communications carriers like public switched telephone network and general packet radio service. Any data compromise due to wire-tapping at the merchant establishment or during the communication carriage can lead to fraud.

Fraudsters can copy information on the magnetic stripe and create an identical card. This is referred to as cloning. For domestic transactions, a combination of EMV, PIN, magnetic stripe and biometric data could prevent frauds as UID could serve as an additional security measure for authentication at the PoS terminal.

Globally, EMV standards were initiated through the coordination of three payment organisations Europay, MasterCard and Visa (EMV). The card and the acceptable devise communicate together and indicate what applications the card and the acceptance devise have in common. The online data authentication further ensures that the card used in the transaction is actually the one issued by the issuer. Many countries are switching to EMV. To address counterfeit frauds, Malaysia and the UK migrated to the EMV chip in 2005 and Singapore followed suit in 2011. Similarly, in Australia and New Zealand, banks have started issuing EMV cards for new and renewed cards. Brazil and Mexico, too, are implementing EMV chips.

The RBI panel said it was crucial that both offline and online PINs are accepted by the electronic data capture machines so as to ensure interoperability. Currently, each PoS or ATM has a unique key for encrypting data originating from a terminal. At the point of sale, if the magnetic strip card and the PIN are to be mandated for all transactions, the terminals will have to be modified to read the full service code on the card and prompt for the PIN. The panel suggests that if the service code on the card does not support the PIN, the terminals should be updated with the bank identification numbers of all issuing banks. This will have to be done by updating the application software loaded at the PoS terminal.

Even otherwise, while it is convenient to swipe your card for payments, you must be confident about paying your outstanding dues on time and in full. Card issuers usually give a credit window of 4-5 weeks from the day you make the spend till the time you get your statement. So, for that period, the credit card spend is like an interest-fee loan. However, this is useful only if you can repay the amount before the due date. The monthly payment should at least cover the minimum amount due, which is usually calculated as 5% of the balance outstanding or the sum of all instalments, interest/other bank charges, the amount utilised over the credit limit, if any, and 1% of the remaining balance outstanding, whichever is higher.

In fact, rolling the credit is much more expensive than taking a personal loan, which can be availed at 18-24% per annum. Moreover, some banks still charge an annual fee just to keep your card active, especially cards that offers users special privileges and loyalty. For example, for a Primary Card, Citibank does not charge any fees if R30,000 or more is spent on the card during the year (a year from the date of issuance of the card). Otherwise, it charges a fee of R1,000 at the end of the year.

Most card issuers levy charges for cash advance, late payments, ECS/cheque bounce, railway ticket booking or cancellation, statement request for beyond three months, outstation cheques and foreign currency transactions. The credit limit is decided by the issuer at the time of giving the card and the available credit limit is printed at the time of generation of each monthly statement. The limit can be raised by the bank after some years if you have a clean payment history and make regular transactions. While most banks fix the limit at the time of issuing the card depending on your income, you can request the bank to increase it after some years depending on an increase in your annual income.

While credit cards cards can also be used like debit cards to withdraw cash, analysts say it should be done only in case of an emergency as banks charge a cash advance fee ranging from 2% to 4% of the withdrawn amount and the amount withdrawn is treated as a loan. Analysts say that to reduce defaults, banks issuing credit cards will have to profile their customers more intensely and devise various customised pricing plans as is done in other developed countries. That will help genuine users use credit cards more effectively without falling in a debt trap.