8 ms·

How India's banks killed the future of commerce

130 points by sankara 16y ago

Charuru 16y ago
It seems to me like it was the government that started the whole mess.
- copper 16y ago
  It usually is :) but cleartrip might just be right here to blame the banks. Asking for more secure authentication is a good idea, particularly in India where on more than one occasion, I've had to stop people from writing down my credit card number for "the record". That transaction volumes decreased on the /first/ day 3-D secure (and now, the one-time password) was implemented is hardly surprising, but I think once customers get used to it it would have returned back to normal.
  - skrish 16y ago
    I agree with your point I have found it hard to prevent merchants from writing down credit card numbers(!!!) and these additional layers of security are needed for the market. On the contrary, though I am a regular user of credit / debit cards for online transactions in India - atleast 3-5 times a month, I have found it really hard to use my credit card from the beginning of the month since they introduced the one-time-password. I have not been able to use my credit card even once since this was introduced due to various reasons - the SMS service that banks are supposed to deliver One-Time-Password is not sent promptly or I do not have a way to get password to authorize even an IVR transaction in time. It might all work out after initial issues are resolved but so far I find this to be a pain.
    - copper 16y ago
      I believe the banks do offer an alternative to go online and generate an OTP. Of course, this does defeat the purpose of an IVR transaction :) For what it's worth, I'm optimistic: the banks might listen to customer complaints and actually do something about it. I admit that I have no idea what they could do: AFAIK there's no way a telco could even guarantee that a SMS is delivered immediately after it is sent
  - Charuru 16y ago
    Interesting to learn. Thanks!
microarchitect 16y ago
Notice how they made the post on Feb 14, but show only data for Feb 1. Is it really surprising that the first day with the new system saw fewer transactions? Making claims that this move "permanently hobbles India's mobile commerce" based on evidence like this is surely unwarranted. I really think 3D secure is a good move. All it requires is entering your internet banking password at the time of making the transaction. Is this really so bad for usability?
- sandGorgon 16y ago
  NO - 3D secure is not good for the customers. the system has no safeguards for vulnerabilities like man-in-the-middle,etc. attacks. Yet it gives credit card companies, the right to deny chargebacks to customers (whose credit card was stolen/hacked) because they can now wash their hands off the matter ("hey only the customer knew the second password... he must have been careless with it, not us")
  - random42 16y ago
    > because they can now wash their hands off the matter ("hey only the customer knew the second password... he must have been careless with it, not us") Seems pretty valid argument to me.
    - roel_v 16y ago
      Rather than downvote it's easy to factually counter your argument: it's not because e.g. keyloggers or mitm attacks can compromise the account. Then afterward, the 2-factor auth is used against the customer as a smokescreen - basically banks say 'oh but we've got this very secure system, it can't be cracked'. Then you have to get into a very technical argument with the bank, which is either hard to win (because only 1 person involved understands, deliberate or not) or impossible (because most customers don't understand the details, and we can't expect them to). This is not a hypothetical situation - this already happens in Western Europe! It's hard to hold banks or merchants responsible for fraud. Now they shouldn't always be held responsible, that's the first issue; but even in cases where they are (like when they guaranteed upfront that they'd take the risk of fraud, as they used to do in the early days of online banking/payment) their first line of defense will be vague 'our technology is tamper proof' arguments. Many consumer association websites are full of stories about this.
trainindia 16y ago
I feel this is a good thing! If you are stupid enough to fail to use and understand the new system, they you wont be able to purchase it. And thus they will end up avoiding huge credit card debt's like poor Americans. Also hardly anyone buys from Amazon and only pathetic people buy from apple iTunes.
radicaldreamer 16y ago
India has a lot of public policy mishaps such as this. It seems that the people making these rules oftentimes don't do adequate research regarding what's feasible for such a large developing, and rapidly changing country. A couple of other examples: There was recently a rule to limit SMS spam by limiting each cell phone to receive a max of 100 texts per day, there still is a rule where you can't entering the country twice within a certain number of days without getting prior permission, IIT students were arbitrarily limited in the number of hours they could spend online because some administrator thought they should get out more, etc.
- zaidf 16y ago
  India is generally conservative about financial issues. In this case, it puts them on the wrong side. But their conservative approach also shielded India from the banking crisis experienced by US etc. From http://www.nytimes.com/2009/06/26/business/global/26reddy.html http://www.nytimes.com/2009/06/26/business/global/26reddy.ht... “If America had a central bank chief like Y. V. Reddy, the U.S. economy would not have been such a mess,” Joseph E. Stiglitz, the economist and Nobel laureate, has said.
  - roel_v 16y ago
    I'm quite willing to be convinced that a conservative monetary system has shielded some countries from certain isssues, but some economist saying so doesn't make it so, not even if he's a famous economist. So some background on the mechanics would be nice.
    - zaidf 16y ago
      Not sure if you read the NYT article but it goes into some detail.
      - roel_v 16y ago
        I guess it depends on the interpretation of "some", but it only broadly says what he did (mostly keeping the market shielded off from international influences it seems, not quite what other countries should emulate - imagine what would happen if T-bonds weren't available to international buyers, or if Americans couldn't freely invest world-wide). It has no details on the economic landscape in India (for example, I have no idea about the housing market there) and it certainly doesn't address the question what effect a looser regime would have had in the light of the economic issues of 2008/09. Now it's an NYT article, on the guy itself and not so much on the economic issues, so for the article, it's fine. But the claim that India was shielded from more economic woes because of this guy is a claim that cannot be backed up with just what is in this article.
senthilnayagam 16y ago
I have stopped using credit cards online for over a year, prefer online banking based payments, because it is one username and 2 passwords(authentication, transaction) I dont like 2 factor authentication, especially with mobile/sms, when I am abroad or travelling, I still can do my transaction
- rmjb 16y ago
  Online banking based payments work just fine for local Indian sites, but I haven't found a way to pay US based businesses without a credit card. The only use I've had for using a credit card has been to pay for AWS and Linode.
deleted 16y ago
[deleted]
rushabh 16y ago
India's systems are generally not designed for the "new entrants" and most of the incumbents design the system with walled gardens to protect themselves. For a startup like us who have a web based software like basecamp, there is no way we can charge subscription services. Infact no payment gateway exists for us to take credit card payments from Indian customers. Thanks to PayPal, we can serve international customers much easily. I have a lot of anger against the people who run India's large services as if its an entitlement, without caring for the new entrants.
goombastic 16y ago
This is nothing. Every time somebody finds an easier way of doing things, the government and the babucracy finds a way of muscling in and making it as bad as all the earlier options. Some of it is not bad, but others are nuts. I should start a list. - Vehicles registered in one state cant be used for too long in another state - Banks have insane policies - Online electronic tax filing requires that you complete the process in paper format as well. To complete the electronic process you have to send it in by normal snail mail as well. And you cant get acknowledgments. - Universities don't recognize each other between states -
- arkitaip 16y ago
  Upvote simply because of babucracy - that's a great term.
- msravi 16y ago
  > Online electronic tax filing requires that you complete the process in paper format as well. To complete the electronic process you have to send it in by normal snail mail as well. And you cant get acknowledgments. Well, you certainly can digitally sign your return - then you won't have to send your physically signed copy.
  - SwaroopH 16y ago
    Yes but obtaining a digital certificate requires paperwork as well. And not to forget, renewing it every year (or two).
    - msravi 16y ago
      There's not too good a way to get around that, is there? You do need to establish your identity by some means initially. Perhaps they can let you renew at less frequent intervals (like they do with passports), but other than that, what do you propose?
      - andrewf 16y ago
JonnieCache 16y ago
Reminds me of the law that existed up until recently in south korea mandating that all financial transactions had to be encrypted using ActiveX. Yes. You read that right. It is as mad as it sounds. http://www.kanai.net/weblog/archive/2007/01/26/00h53m55s#003095 http://www.kanai.net/weblog/archive/2007/01/26/00h53m55s#003...
nakkal 16y ago
One reason Government has to come up with restrictions like that is because banks and credit card companies do not protect the consumer in case of card theft unlike here in the US where the customer is liable for only the first $50. All the fraudulent charges are the customers responsibility.
known 16y ago
In India, e-Governance = e-Redtape

130 points by sankara 16y ago

Charuru 16y ago

It seems to me like it was the government that started the whole mess.

copper 16y ago
It usually is :) but cleartrip might just be right here to blame the banks. Asking for more secure authentication is a good idea, particularly in India where on more than one occasion, I've had to stop people from writing down my credit card number for "the record". That transaction volumes decreased on the /first/ day 3-D secure (and now, the one-time password) was implemented is hardly surprising, but I think once customers get used to it it would have returned back to normal.
- skrish 16y ago
  I agree with your point I have found it hard to prevent merchants from writing down credit card numbers(!!!) and these additional layers of security are needed for the market. On the contrary, though I am a regular user of credit / debit cards for online transactions in India - atleast 3-5 times a month, I have found it really hard to use my credit card from the beginning of the month since they introduced the one-time-password. I have not been able to use my credit card even once since this was introduced due to various reasons - the SMS service that banks are supposed to deliver One-Time-Password is not sent promptly or I do not have a way to get password to authorize even an IVR transaction in time. It might all work out after initial issues are resolved but so far I find this to be a pain.
  - copper 16y ago
    I believe the banks do offer an alternative to go online and generate an OTP. Of course, this does defeat the purpose of an IVR transaction :) For what it's worth, I'm optimistic: the banks might listen to customer complaints and actually do something about it. I admit that I have no idea what they could do: AFAIK there's no way a telco could even guarantee that a SMS is delivered immediately after it is sent
- Charuru 16y ago
  Interesting to learn. Thanks!

microarchitect 16y ago

Notice how they made the post on Feb 14, but show only data for Feb 1. Is it really surprising that the first day with the new system saw fewer transactions? Making claims that this move "permanently hobbles India's mobile commerce" based on evidence like this is surely unwarranted. I really think 3D secure is a good move. All it requires is entering your internet banking password at the time of making the transaction. Is this really so bad for usability?

sandGorgon 16y ago
NO - 3D secure is not good for the customers. the system has no safeguards for vulnerabilities like man-in-the-middle,etc. attacks. Yet it gives credit card companies, the right to deny chargebacks to customers (whose credit card was stolen/hacked) because they can now wash their hands off the matter ("hey only the customer knew the second password... he must have been careless with it, not us")
- random42 16y ago
  > because they can now wash their hands off the matter ("hey only the customer knew the second password... he must have been careless with it, not us") Seems pretty valid argument to me.
  - roel_v 16y ago
    Rather than downvote it's easy to factually counter your argument: it's not because e.g. keyloggers or mitm attacks can compromise the account. Then afterward, the 2-factor auth is used against the customer as a smokescreen - basically banks say 'oh but we've got this very secure system, it can't be cracked'. Then you have to get into a very technical argument with the bank, which is either hard to win (because only 1 person involved understands, deliberate or not) or impossible (because most customers don't understand the details, and we can't expect them to). This is not a hypothetical situation - this already happens in Western Europe! It's hard to hold banks or merchants responsible for fraud. Now they shouldn't always be held responsible, that's the first issue; but even in cases where they are (like when they guaranteed upfront that they'd take the risk of fraud, as they used to do in the early days of online banking/payment) their first line of defense will be vague 'our technology is tamper proof' arguments. Many consumer association websites are full of stories about this.

trainindia 16y ago

I feel this is a good thing! If you are stupid enough to fail to use and understand the new system, they you wont be able to purchase it. And thus they will end up avoiding huge credit card debt's like poor Americans. Also hardly anyone buys from Amazon and only pathetic people buy from apple iTunes.

radicaldreamer 16y ago

India has a lot of public policy mishaps such as this. It seems that the people making these rules oftentimes don't do adequate research regarding what's feasible for such a large developing, and rapidly changing country. A couple of other examples: There was recently a rule to limit SMS spam by limiting each cell phone to receive a max of 100 texts per day, there still is a rule where you can't entering the country twice within a certain number of days without getting prior permission, IIT students were arbitrarily limited in the number of hours they could spend online because some administrator thought they should get out more, etc.

zaidf 16y ago
India is generally conservative about financial issues. In this case, it puts them on the wrong side. But their conservative approach also shielded India from the banking crisis experienced by US etc. From http://www.nytimes.com/2009/06/26/business/global/26reddy.html http://www.nytimes.com/2009/06/26/business/global/26reddy.ht... “If America had a central bank chief like Y. V. Reddy, the U.S. economy would not have been such a mess,” Joseph E. Stiglitz, the economist and Nobel laureate, has said.
- roel_v 16y ago
  I'm quite willing to be convinced that a conservative monetary system has shielded some countries from certain isssues, but some economist saying so doesn't make it so, not even if he's a famous economist. So some background on the mechanics would be nice.
  - zaidf 16y ago
    Not sure if you read the NYT article but it goes into some detail.
    - roel_v 16y ago
      I guess it depends on the interpretation of "some", but it only broadly says what he did (mostly keeping the market shielded off from international influences it seems, not quite what other countries should emulate - imagine what would happen if T-bonds weren't available to international buyers, or if Americans couldn't freely invest world-wide). It has no details on the economic landscape in India (for example, I have no idea about the housing market there) and it certainly doesn't address the question what effect a looser regime would have had in the light of the economic issues of 2008/09. Now it's an NYT article, on the guy itself and not so much on the economic issues, so for the article, it's fine. But the claim that India was shielded from more economic woes because of this guy is a claim that cannot be backed up with just what is in this article.

senthilnayagam 16y ago

I have stopped using credit cards online for over a year, prefer online banking based payments, because it is one username and 2 passwords(authentication, transaction) I dont like 2 factor authentication, especially with mobile/sms, when I am abroad or travelling, I still can do my transaction

rmjb 16y ago
Online banking based payments work just fine for local Indian sites, but I haven't found a way to pay US based businesses without a credit card. The only use I've had for using a credit card has been to pay for AWS and Linode.

deleted 16y ago

[deleted]

rushabh 16y ago

India's systems are generally not designed for the "new entrants" and most of the incumbents design the system with walled gardens to protect themselves. For a startup like us who have a web based software like basecamp, there is no way we can charge subscription services. Infact no payment gateway exists for us to take credit card payments from Indian customers. Thanks to PayPal, we can serve international customers much easily. I have a lot of anger against the people who run India's large services as if its an entitlement, without caring for the new entrants.

goombastic 16y ago

This is nothing. Every time somebody finds an easier way of doing things, the government and the babucracy finds a way of muscling in and making it as bad as all the earlier options. Some of it is not bad, but others are nuts. I should start a list. - Vehicles registered in one state cant be used for too long in another state - Banks have insane policies - Online electronic tax filing requires that you complete the process in paper format as well. To complete the electronic process you have to send it in by normal snail mail as well. And you cant get acknowledgments. - Universities don't recognize each other between states -

arkitaip 16y ago
Upvote simply because of babucracy - that's a great term.
msravi 16y ago
> Online electronic tax filing requires that you complete the process in paper format as well. To complete the electronic process you have to send it in by normal snail mail as well. And you cant get acknowledgments. Well, you certainly can digitally sign your return - then you won't have to send your physically signed copy.
- SwaroopH 16y ago
  Yes but obtaining a digital certificate requires paperwork as well. And not to forget, renewing it every year (or two).
  - msravi 16y ago
    There's not too good a way to get around that, is there? You do need to establish your identity by some means initially. Perhaps they can let you renew at less frequent intervals (like they do with passports), but other than that, what do you propose?
    - andrewf 16y ago

JonnieCache 16y ago

Reminds me of the law that existed up until recently in south korea mandating that all financial transactions had to be encrypted using ActiveX. Yes. You read that right. It is as mad as it sounds. http://www.kanai.net/weblog/archive/2007/01/26/00h53m55s#003095 http://www.kanai.net/weblog/archive/2007/01/26/00h53m55s#003...

nakkal 16y ago

One reason Government has to come up with restrictions like that is because banks and credit card companies do not protect the consumer in case of card theft unlike here in the US where the customer is liable for only the first $50. All the fraudulent charges are the customers responsibility.

known 16y ago

In India, e-Governance = e-Redtape