The Reserve Bank of India’s (RBI) decision to tighten security for using credit cards on the Internet has brought welcome focus to financial frauds. While online transactions will now have, what is described as an ‘additional layer of security’, there isn’t much meaningful security that can be provided without a good understanding of what is being done.
At its root, the kind of online credit card fraud that the RBI is trying to tackle has a lot in common with the kind of investment-related frauds that are fairly widespread in this country. Are investment frauds really widespread? I think they are. They just attain a certain amount of invisibility in front of the media and most affluent urbanites because they operate on a different plane. There are any number of deposit schemes, gold schemes, ‘guaranteed return’ schemes and the like that flourish in smaller towns and indeed in parts of bigger cities as well. They seem to be able to operate completely under the radar of the regulatory framework that is supposed to prevent them.
The similarity between these ‘investment’ schemes and online fraud is that they all fool their victims by making sure that they resemble the real thing. These investment schemes offer certificates and receipts that look just as legitimate as real ones. Or, they create a feeling of substance, weight and trust using other cues that people respond to. Some of us have a markedly lower threshold of ‘trustability’ and even put our faith outright in confidence tricksters like Ashok Jadeja or the plantation companies.
Unless victims themselves learn to distinguish the ersatz from the real, there’s little meaningful security that is possible. In online transactions, the kind of security that the new rule provides is against some individual surreptitiously using a credit card number to make a transaction. Under the new rule, that individual will be transferred to your bank’s website where he will have to enter an ‘I-PIN’ number that, presumably, only you will know.
However, most online fraud victims end up entering their credit card or Internet banking credentials on websites that are made to look like the real ones but are actually fake. Or, they enter their credentials from insecure computers that have keyloggers and screenloggers installed. The new ‘I-PIN’ based system will be completely ineffective against such fraud. The scamsters who make perfect replicas of legitimate e-commerce and bank websites’ screens to capture data will also make perfect replicas of the I-PIN entering screens and capture the accompanying I-PINs.
I’ve said this earlier in a similar context, but in dealing with any kind of financial or investment intermediary, there’s no substitute for distrust. As financial interactions have become more complex, there’s also no substitute for learning how to distinguish the fakes from the real. In the online world, this is actually relatively easy. In the physical world, it requires a constant scepticism. In both, the attitude to take is that of considering everyone as guilty unless proven innocent. Whether you are opening a transactional website or listening to someone pitch on an investment, you should be saying to yourself, “I’m sure this is a scam. I’ll need some positive proof that it isn’t.”
Also Read:
Distrust, Investors and Godmen
Ask Value Research 
New episodes every Friday 
New Process Alert 
Seems like you've uploaded a wrong QR code. Please upload the QR code downloaded from MF Central platform.
