RBI has issued a circular on 26 November, 2013 regarding security of card present transactions. Banks may now take a decision on whether to use EMV chip and PIN technology or use Aaadhar cards as an additional factor of authentication for securing card present transactions.
It may be recalled that RBI in a circular in February 2013 had stated that all cards that have used in international locations (the person has physically used the card from a foreign location) should be converted to EMV Chip and PIN technology. But, with the cost involved, time and technology requirements, Indian Banks found it difficult to adhere to the deadline and some interested stake holders approached RBI for an extension of the deadline. RBI granted an extension till 30th November 2013 by which time it was expected that all cards that had been used in international locations i.e. only those that had been used in international locations, not e-commerce transactions should be converted to EMV cards supported by PINs to make it more secure.
The current RBI circular of 26 November says “In respect of cards, not specifically mandated by the Reserve Bank to adopt EMV norms, banks may take a decision whether they should adopt Aadhaar as additional factor of authentication or move to EMV Chip and Pin technology for securing the card present payment infrastructure.”
The part that says “not specifically mandated by the Reserve Bank to adopt EMV norms”, applies to cards that have been used internationally.
The circular also says “All new card present infrastructure has to be enabled for both EMV chip and PIN and Aadhaar (biometric validation) acceptance.”, so Banks have to enable all new devices for EMV and Biometric validation.
EMV Chip and Pin cards are more secure than traditional magnetic stripe cards. It cannot be ‘skimmed’ using cheap card readers (like how magnetic cards can be). When a card is lost, it cannot be used as it requires a PIN. (Though PIN based authentication is not compulsory according to the original specification of the EMV and signature authentication is provided for). RBI mandates usage of PIN for chip based cards.
In markets, like the UK, where the EMV cards have been introduced, there is a visible dip in card related fraud. Even countries in the Asia-Pacific region where the cards have been introduced have recorded a reduction in card based fraud.
Biometric (finger print/retina scan) captured by UIDAI can be used as authentication to protect against both domestic counterfeit and lost & stolen card fraud as the cardholder has to be physically present at the POS terminal/ATM to authenticate the transaction. Even if the card is counterfeited, the fraudster will not be able to use the card as biometric of the customer would be required.
Information Security, SSAE 16, ISO 27001, CISA, Cert-IN
Comments are closed.