Techno-Legal Measures To Prevent ATM Frauds In India

Reserve Bank of India (RBI) has recently released the report of its working group on securing card present transaction that covers ATM security as well. RBI has also prescribed cyber security due diligence for banks of India. Despites these pro active steps, ATM frauds are increasing in India.

ATM frauds are executed by techniques like wire tapping, replicating the digital signature of the card, getting authentic personal data at fake data call centres, tampering ATM slots by rigging, phishing through e-mail accounts and fixing hidden cameras at vantage points inside ATM installations to steal the secret PIN number of the customers. Fraudsters use special devices like skimmers, duplicate ATMs, to withdraw stacks of money from ATMs.

In this interview of Praveen Dalal, Managing Partner of New Delhi based ICT Law Firm Perry4Law and leading Techno Legal Expert of India, he has shared the techno legal methods to prevent ATM Frauds in India. ATM frauds can be tackled by using techno legal measures alone.

Q-1 Apart from the spamming and phishing, what are the various kinds of ATM frauds? Please specify the ones that take place at the ATM machine or at the counter.

A.1 ATM frauds happen when someone leaves his/her credit card unattended in a vehicle or changing room or allows anyone else to use the card or looses the card that is misused by others or discloses the Personal Identification Number (PIN) to others, etc. These mistakes allow the offender to withdraw money by using the stolen information. Fraudsters are using special devices, skimmers, duplicate ATMs, etc to withdraw money from ATMs. Sometimes such frauds are an insider job with the collusion of the employees of the company issuing those cards.

Q-2 Out of all the techniques, which one is the most common?

A.2 The misuse of disclosed PIN for withdrawing money is the most common techniques used for committing ATM Frauds.

Q. 3 What the individual can do to avoid their money from being siphoned off due to ATM fraud?

A.3 Some basic precautions by the card holders can be very effective in preventing ATM frauds. For instance, never leave your credit card unattended in a vehicle or changing room, never allow anyone else to use your card, always retain sales/charge slips to compare with the amount specified on the billing statement, do not disclose your PIN to anyone, etc.

Q. 4 Is any new technology available to handle ATM frauds? If yes, please elaborate.

A.4 The technological mechanisms like Designated time, Microchip technology, Biometric tokens, Enhanced security, ATM Monitoring, Customised softwares, Customer motivation, Alerts, etc can be used to minimise and prevent ATM frauds in India.

Q.5 What is the scenario abroad? Are ATM frauds more rampant outside?

A.5 The culture of e-banking is more prevalent in foreign countries. Obviously, the menace of ATM frauds is more in those countries. However the problem of ATM frauds is global in nature and its ramifications have been felt in India as well. Information and Communication Technology (ICT) is forcing Indian legal system to adapt itself as per its requirements. Presently, there is a lack of legal enablement of ICT systems in India and we need good laws in this regard.

Q. 6 What does IT Act 2000 say about ATM frauds?

A.6 The IT Act, 2000 does not contain any specific provisions regarding the same and the traditional law of IPC, 1860 also cannot be relied solely and independently to tackle this problem. We need a better law for this purpose and Perry4Law has already provided its suggestions and recommendations in this regard and other ICT related matters to the Government of India, Department of Information Technology, Department of Science and Technology, Prime Minister’s Office, etc. Till we have suitable and apt laws, we must apply existing laws in a purposive and updating manner.

RBI Acknowledges Risks Of E-Banking In India

Reserve Bank of India (RBI) has been playing a pro active role for securing Internet banking and online banking transactions. Recently, RBI showed its intention to boost ATM security in India. In the past, concerns have been raised from time to time for preventing online banking frauds in India by RBI.

There are many problems from which the online banking or Internet banking in India is suffering. The most important pertains to maintaining effective cyber security for banking and financial sectors of India. Similarly, there are no effective Internet banking laws in India or online banking laws in India. In the absence of stringent laws in this regard, online banking risks in India are increasing. However, of all the shortcomings, nothing can match the absence of encryption laws and standards in India. In the absence of proper encryption norms in India, e-banking in India is really insecure.

RBI has realised this fact and it has cautioned banks that e-banking must be used by them with proper security and safeguards. “The use of e-banking has brought many concerns from different stakeholders. Everybody’s primary concern is security. As more and more people are exposed to the information superhighway, privacy of information and the security that goes hand and hand with this information is crucial to the growth of electronic transactions,’’ said R Gandhi, executive director , Reserve Bank of India.

Gandhi said in order to provide effective and secure banking transactions, there are four technology issues that need to be resolved. “The key areas are the security, privacy and authentication,” he said. By strengthening the privacy technology, this will ensure the secrecy of sender’s personal information and enhance the system’s security. “Also encryption may help make the transactions more secure, but there is also a need to guarantee that no one alters the data at either end of the transaction,” Gandhi said.

Recently, G Gopalakrishna, the executive director of RBI, said that all Banks would have to create a position of Chief Information Officers (CIOs) as well as Steering Committees on Information Security at the Board Level at the earliest, informs Praveen Dalal, managing partner of New Delhi based ICT law firm Perry4Law and leading techno legal specialist of India. This step was taken to ensure proper Cyber Security Policies and Strategies at the highest Board Level of Banks, says Dalal.

Although, RBI has been taking many far reaching and important steps yet e-banking in India still very risky. Of late, cases of phishing and banking frauds have increased tremendously in India. Further, cyber due diligence of banks in India is still a far dream. Even the directions of RBI to appoint CIOs and steering committees on information security have not yet been implemented. The end result is that banking customers are still losing their hard earned money to cyber criminals. Hopefully, RBI would take some urgent steps in these directions as soon as possible, says Praveen Dalal.