In the last few weeks, multiple instances of data breaches, especially in debit and automated teller machine (ATM) cards, have surfaced. Banks have described these instances as cyber data breaches and said that no monetary losses have been reported. However, the National Payments Council of India (NPCI) said in a statement that the total amount involved is Rs1.3 crore as reported by various affected banks.
"The incidents have started getting reported since last 48 days. We know about it based on the precautionary measures taken by the banks. For instance, some banks sent out SMS alerts to change personal identification number (PIN) of cards, which they suspect have been compromised. Another bank decided to reissue the debit cards where it believes data has been compromised on the physical card," said Sivarama Krishnan, cybersecurity leader, PwC.
In September, banks including HDFC Bank Ltd, Kotak Mahindra Bank Ltd and Federal Bank Ltd sent out SMSs asking some customers to change the PIN of their debit card, as a precaution. In the messages, banks mentioned that due to a spike in fraudulent transactions at ATMs in banks, debits cards could have been compromised. So to protect the account, banks advised the customers to change their PINs immediately.
The country's largest lender State Bank of India (SBI) is reissuing over 600,000 debit cards. It said in a statement card network companies such as NPCI, Mastercard and Visa had informed banks in India about a potential risk to some cards due to data security breach. "Accordingly, SBI has taken precautionary measures and has blocked cards of certain customers identified by the networks," an SBI spokesperson said. The bank is issuing new cards at no cost to the customers whose cards have been blocked. Recently, Axis Bank Ltd also reported to the Reserve Bank of India (RBI) about a potential threat . "We proactively communicate potential threats to the regulator to maintain broader systemic integrity. Our internal monitoring mechanism identified such a threat recently and all steps have been undertaken to neutralise the same. There has been no loss to our customers," said an Axis Bank spokesperson in a statement.
Liability in case of fraud
According to Axis Bank, many large financial institutions across the globe often receive security threats from various sources. Security experts and information technology (IT) professionals constantly monitor the systems to neutralise any threat. "The frauds that recently surfaced were brought to the notice of NPCI by the banks when they suspected unauthorised transaction at ATMs," said Puneet Kapoor, senior executive vice-president, Kotak Mahindra Bank.
All the recently reported debit card data breaches have happened at the banks' level. According to the RBI, banks are responsible for security of the debit cards they issue: "Hence, in case of any monetary loss on account of breach of security or failure of security, the bank is liable to bear the loss," it said in a circular.
The bank is liable if there has been a failure of its systems and infrastructure resulting in fraud. According to the RBI, if a transaction has taken place without the additional factor of authentication and a customer has complained that the transaction was not effected by her, the issuer bank will reimburse the customer.
If you have lost any money, you need to immediately inform the bank about the loss. If you don't inform the bank about the loss or theft, the bank cannot be held liable. "If you have been a victim of fraud, it is important to report any loss to the bank. Banks depend on the CCTV footage also, which is usually available for 90 days-hence immediate reporting is a must," said Kapoor. Once you report the loss, it is the bank's responsibility to stop further use of the card. If the cardholder is found negligent, she will have to bear the liability. In a draft circular on customer protection, RBI said that a customer will not be liable where fraud or negligence is on the part of the bank or for a third-party breach, where the customer notifies the bank within 3 working days of receiving a communication from the bank on any unauthorised transaction. "Where customer's own involvement is not clearly established, customer liability will be limited to a maximum of Rs5,000 if she reports within 4 to 7 working days and if customer reports beyond 7 working days, customer liability will be determined based on bank's Board approved policy," stated the draft.
How to protect yourself
There is little a customer can do if the breach has happened at the bank level. "If there is mass data security breach, there is not much customers can do," said Amit Jaju, executive director-fraud investigation and dispute services, EY. In the future, take precautions such as setting a limit on you card. "Many banks allow you to set cash withdrawal and transaction limits. You can do it using Net banking. Hence, you are exposed to only a limited amount of fraud," said Jaju.
Change your PIN regularly. "Never re-use old PINs. Pay attention to transaction alerts coming from your bank. In case you receive an alert of a transaction not authorised by you, inform your bank immediately," said Rajiv Anand, executive director, Axis Bank. Update you mobile number and email ID with the bank to receive all transaction alerts."Unless you are a frequent traveller, keep the international usage inactive to avoid these issues," said Kapoor.
In arrangement with HT Syndication | MINT
Ask Value Research 
New episodes every Friday 
New Process Alert 
Seems like you've uploaded a wrong QR code. Please upload the QR code downloaded from MF Central platform.
