4 ms·
RBI(Central bank) has been filling-up for a long time for the total lack of security practices by merchants & data-privacy laws. e.g. One can control how much
by Abishek_Muthian 5y ago
RBI(Central bank) has been filling-up for a long time for the total lack of security practices by merchants & data-privacy laws.
e.g. One can control how much money can be withdrawn from the credit/debit card per-day according to domestic/International merchants/online/physical/ATM/ etc. through net-banking with the minimum in the multiples of INR 1000. So even if the card data gets stolen, Criminals can utmost withdraw only the minimum amount in the other part of the world.
But unfortunately due to the digital-divide, Not many have access or awareness of such facilities and hence control over card data is required.
IMO the single point of failure for India's financial security is its extraordinary dependence on mobile number for 2FA, Even security conscious customers can do little against SIM jacking attacks, But for those who are not security conscious; all it requires is a social engineered SMS with ngrok URL[1] or Phone call asking for that OTP.
Please write to RBI and demand your bank to support hardware tokens (or) at least TOTP.
> 3. PayTm (One of the largest, if not the largest digital payments app in India)
Did you mean that largest digital payments company which integrated the PoS facility on the merchant's app and the customers were asked to enter their credit/debit card details manually?[2]
[1] https://twitter.com/Abishek_Muthian/status/1406964960081571845 https://twitter.com/Abishek_Muthian/status/14069649600815718...
[2] https://abishekmuthian.com/paytm-says-to-me-that-its-pos-feature-didn-t-have-a-security-risk-8fd7c3849e54/ https://abishekmuthian.com/paytm-says-to-me-that-its-pos-fea...
- andi999 5y agoSo who has to pay up. What I mean, let's say your cc data gets stolen and somebody draws money from your card, can't you just initiate a charge back?
- Abishek_Muthian 5y agoAlthough charge back mechanisms exists for merchant transactions, I don't know of anyone who had got back their money lost through the theft of their card data. I wouldn't be surprised if VISA/MASTER/AMEX don't have such liabilities in India as they do in US/Europe. I had a conversation with cyber-crime police reg the aforementioned SMS scam using ngrok, They mentioned that many in my city have lost huge sums of money through it and the scam is not just for stealing bank credentials, the attacker's application tries to exploit victim's system and had successfully installed RAT. Successive Indian Govt. have been at loggerheads with VISA/MASTER duopoly and have successfully derailed it for domestic payments, Now Unified Payments Interface(UPI)[1] which works with payment apps has more transactions than debit/CC. So the domestic criminals have largely switched to UPI/Bank account based scams. Occasionally some of these criminals get caught and some get their money back. [1] https://timesofindia.indiatimes.com/business/india-business/cash-no-longer-king-upi-transactions-up-70-times-in-last-4-years-debit-card-transactions-dip/articleshow/88116060.cms https://timesofindia.indiatimes.com/business/india-business/...
- PeterisP 5y agoChargeback rights and liability of fraud for creditcards are significantly different in different regions even for seemingly identical visa/mastercard cards.
- andi999 5y agoYes, it is interesting though how it is in India, which might put low incentives on the companies to ramp up security.