Techno-Legal Measures To Prevent ATM Frauds In India

Reserve Bank of India (RBI) has recently released the report of its working group on securing card present transaction that covers ATM security as well. RBI has also prescribed cyber security due diligence for banks of India. Despites these pro active steps, ATM frauds are increasing in India.

ATM frauds are executed by techniques like wire tapping, replicating the digital signature of the card, getting authentic personal data at fake data call centres, tampering ATM slots by rigging, phishing through e-mail accounts and fixing hidden cameras at vantage points inside ATM installations to steal the secret PIN number of the customers. Fraudsters use special devices like skimmers, duplicate ATMs, to withdraw stacks of money from ATMs.

In this interview of Praveen Dalal, Managing Partner of New Delhi based ICT Law Firm Perry4Law and leading Techno Legal Expert of India, he has shared the techno legal methods to prevent ATM Frauds in India. ATM frauds can be tackled by using techno legal measures alone.

Q-1 Apart from the spamming and phishing, what are the various kinds of ATM frauds? Please specify the ones that take place at the ATM machine or at the counter.

A.1 ATM frauds happen when someone leaves his/her credit card unattended in a vehicle or changing room or allows anyone else to use the card or looses the card that is misused by others or discloses the Personal Identification Number (PIN) to others, etc. These mistakes allow the offender to withdraw money by using the stolen information. Fraudsters are using special devices, skimmers, duplicate ATMs, etc to withdraw money from ATMs. Sometimes such frauds are an insider job with the collusion of the employees of the company issuing those cards.

Q-2 Out of all the techniques, which one is the most common?

A.2 The misuse of disclosed PIN for withdrawing money is the most common techniques used for committing ATM Frauds.

Q. 3 What the individual can do to avoid their money from being siphoned off due to ATM fraud?

A.3 Some basic precautions by the card holders can be very effective in preventing ATM frauds. For instance, never leave your credit card unattended in a vehicle or changing room, never allow anyone else to use your card, always retain sales/charge slips to compare with the amount specified on the billing statement, do not disclose your PIN to anyone, etc.

Q. 4 Is any new technology available to handle ATM frauds? If yes, please elaborate.

A.4 The technological mechanisms like Designated time, Microchip technology, Biometric tokens, Enhanced security, ATM Monitoring, Customised softwares, Customer motivation, Alerts, etc can be used to minimise and prevent ATM frauds in India.

Q.5 What is the scenario abroad? Are ATM frauds more rampant outside?

A.5 The culture of e-banking is more prevalent in foreign countries. Obviously, the menace of ATM frauds is more in those countries. However the problem of ATM frauds is global in nature and its ramifications have been felt in India as well. Information and Communication Technology (ICT) is forcing Indian legal system to adapt itself as per its requirements. Presently, there is a lack of legal enablement of ICT systems in India and we need good laws in this regard.

Q. 6 What does IT Act 2000 say about ATM frauds?

A.6 The IT Act, 2000 does not contain any specific provisions regarding the same and the traditional law of IPC, 1860 also cannot be relied solely and independently to tackle this problem. We need a better law for this purpose and Perry4Law has already provided its suggestions and recommendations in this regard and other ICT related matters to the Government of India, Department of Information Technology, Department of Science and Technology, Prime Minister’s Office, etc. Till we have suitable and apt laws, we must apply existing laws in a purposive and updating manner.

Are Indian Banks Ready For Cyber Due Diligence?

Recently Reserve Bank of India (RBI) constituted a working group on information security that gave its report to RBI. Subsequently RBI issued a notification asking the bank to follow the guidelines and recommendations mentioned in the notification. The notification had demarcated the immediately implementable and subsequently implementable aspects of these recommendations.

This “notification” has set a specific timeline for implementation of the final recommendations of working Group. While not all these recommendations are immediately implementable yet some of them are and banks of India must comply with the same till October 31, 2011, informs B.S.Dalal, senior partner of New Delhi based law firm Perry4Law and an ex manager of RBI. These mandatory recommendations pertain to policies and procedures which do not require extensive investment, informs Dalal.

In order to provide focused project oriented approach towards implementation of these guidelines, banks would be required to conduct a formal gap analysis between their current status and stipulations as laid out in the circular and put in place a time-bound action plan to address the gap and comply with the guidelines.

However, banks need to ensure implementation of basic organizational framework and put in place policies and procedures which do not require extensive budgetary support, infrastructural or technology changes, by October 31, 2011. The rest of the guidelines need to be implemented within period of one year unless a longer time-frame is indicated in the circular. There are also a few provisions which are recommendatory in nature, implementations of which are left to the discretion of banks.

It is clear that not all provisions of the report are discretionary but only a small portion of the same. Banks have to establish adequate cyber security and cyber due diligence mechanisms within stipulate periods otherwise action can be taken against them by RBI.

Recently RBI imposed penalty upon 19 banks for non compliance of prescribed standards. Similarly, RBI has also directed that any strictures passed against directors of a bank by any financial sector regulators must be reported to it. Non compliance of the recommendations of RBI working group may attract both penalty and strictures, suggest B.S.Dalal.

The notification also suggests a quarterly review process and the first calendar quarter after the issue of the guideline falls on 30th June 2011. Banks must do the needful in their own interest. They may also seek the expert techno legal services of Perry4Law and Perry4Law Techno Legal Base (PTLB) in this regard. Interested banks and financial institutions may contact them in this regard.

E-Banking In India

Reserve Bank of India (RBI) has come across many complaints and disputes regarding fraudulent credit card, online banking and ATM transactions. Even phishing incidences have sharply arisen in India resulting in loss of money of public at large. RBI ombudsmen office has been flooded with such complaints.

In these circumstances, online banking in India is risky. We have no e-banking laws in India and this also makes the mobile banking in India risky. Even RBI has acknowledged risks of e-banking in India.

E-banking in India cannot succeed till a strong legal framework in this is enacted. According to Praveen Dalal, managing partner of New Delhi based law firm Perry4Law and leading techno legal expert of India, we have no dedicated E-Banking Law in India. Although, RBI has issued many guidelines in this regard and even our Information Technology Act, 2000 contains some indirect and implied provisions for Internet or E-Banking yet we need a separate and dedicated law in this regard, opines Praveen Dalal.

Recently, G Gopalakrishna, the executive director of RBI, said that all Banks would have to create a position of Chief Information Officers (CIOs) as well as Steering Committees on Information Security at the Board Level at the earliest, informs Dalal. This step was taken to ensure proper Cyber Security Policies and Strategies at the highest Board Level of Banks, says Dalal.

Although RBI has mandated cyber due diligence for banks in India especially the due diligence for banks under IT Act 2000 yet banks have still to keep their functions in order. Indian banks are poor at cyber security and they are in no mood to appoint CIOs and steering committee.

Recently the final report of working group of RBI on Information Security, Electronic Banking, Technology Risk Management and Cyber Frauds has been released. It has prescribed the time limits for implementation of RBI recommendations on information security. With the deterrent approach of RBI towards non compliance, it would be safe to presume that CIOs, steering committee and cyber security related compliances would also be taken seriously by RBI.

It is high time for banks operating in India to keep their e-banking infrastructure technologically and legally sound. The best option for banks seems to be to adopt Techno Legal Measures that covers both Technical and Legal aspects of Banking, suggests Dalal.

Non Compliance Penalty Imposed By RBI Upon 19 Commercial Banks

Reserve Bank of India (RBI) is the apex bank of India that regulates the conduct of various commercial banks of India. If these commercial banks are found deviant they are also penalized by RBI.

Recently, RBI has imposed penalties upon 19 commercial banks like Axis Bank Ltd, Barclays Bank PLC, HDFC Bank Ltd, ICICI Bank Ltd, Kotak Mahindra Bank Limited, Yes Bank Ltd, BNP Paribas, Citi Bank NA, Credit Agricole – CIB, Development Credit Bank Ltd, ING Vysya Bank Ltd, Royal Bank of Scotland, Standard Chartered Bank, State Bank of India, Bank of America NA, DBS Bank Ltd, Deutsche Bank AG, Hongkong and Shanghai Banking Corporation Ltd and JP Morgan Chase Bank NA.

By exercising its powers under the provisions of Section 47A (1) (b) read with Section 46(4) (i) of the Banking Regulation Act, 1949, RBI imposed these penalties. The penalties have been imposed on these banks for contravention of various instructions issued by the Reserve Bank in respect of derivatives, such as, failure to carry out due diligence in regard to suitability of products, selling derivative products to users not having risk management policies and not verifying the underlying/ adequacy of underlying and eligible limits under past performance route.

The Reserve Bank had issued Show Cause Notices to these banks. In response to this, the banks submitted their written replies. On a careful examination of the banks’ written replies and the oral submissions made during the personal hearings, the Reserve Bank found that the violations were established and the penalties were thus imposed.

RBI has been taking many pro active reforms for the Banking Sector of India, says Praveen Dalal, managing partner of New Delhi base ICT law firm Perry4Law and leading cyber law expert of India.. RBI is not only ensuring strict compliance with various Laws, Regulations and Norms but is also prescribing various Policies and Strategies for Effective and Secure Banking in India, informs Dalal. Ensuring Cyber Security for preventing Cyber Crimes has been recently directed by RBI that all Commercial Banks of India must follow, informs Dalal.

However, although the directions of cyber security are of great interest yet banks have failed to comply with the same. For instance, till now the directions of RBI to appoint CIOs and steering committee has not been followed by banks of India. Similarly, banks of India are also at fault for ignoring the cyber security requirements.

RBI must take these non compliances very seriously as banking customers interest are at stake. Just like it imposed penalties for non compliance in the present case, penalties for non compliance with cyber security requirements must also be imposed by RBI. Let us see how RBI would react to this situation.

Indian Banks Are Poor At Cyber Security Policy

Banking industry of India has started using information and communication technology (ICT) for various banking related affairs. However, with the growing use of ICT, cyber crimes and banking frauds have also increased. Although Reserve Bank of India (RBI) has taken many pro active steps to introduce cyber security element in the Indian banking sector yet banks of India are not using the same at all.

For instance, RBI has recently directed that all banks would have to create a position of chief information officers (CIOs) as well as steering committees on information security at the board level at the earliest. This direction was provided through the information technology vision document for 2011-17 (IT Vision 2011-17). This document has suggested many technological as well as legal reforms for banking sector of India.

However, banks of India have shown no willingness to incorporate cyber security into their day to day functions. Till now the directions of RBI to appoint CIOs and steering committee has not been followed by banks of India.

Cyber Security Policy is an issue that is very important for Banks of India, says Praveen Dalal, managing partner of New Delhi base ICT law firm Perry4Law and leading cyber law expert of India. With the growing use of Internet Banking, ATM machines, Credit and Debit Cards, Online Banking, etc, Banks of India must also upgrade their Cyber Security Infrastructure and establish a Cyber Security Policy, suggests Dalal.

RBI has to make it sure that its directions regarding cyber security policy and practices are accepted and implemented by banks operating in India. Till now Indian banks have shown a poor track record of cyber security usage.

RBI Guidelines On Steering Committee And CIO Not Followed

Reserve bank of India (RBI) has recently directed that all banks would have to create a position of chief information officers (CIOs) as well as steering committees on information security at the board level at the earliest.

This direction was provided through the information technology vision document for 2011-17 (IT Vision 2011-17). It has suggested many technological as well as legal reforms for banking sector of India.

Although the direction to have CIOs and steering committee is very clear yet till now banks in India has failed to comply with this direction. RBI said that the banks need to ensure implementation of basic IT organisational framework and put in place policies and procedures which do not require extensive budgetary support, infrastructural or technology changes, by October 31, 2011. The rest of the guidelines need to be implemented within period of one year unless a longer time-frame is indicated.

Till now there are no hints given by banks of India that they are taking the cyber security aspects of banking seriously. With growing cases of ATM frauds, credit card frauds, online banking frauds, etc banks of India need to take immediate steps to strengthen their cyber security practices.

It seems RBI needs to remind the banks once again about this much needed requirement so that harassment of banking customers can be minimised in India.

RBI Acknowledges Risks Of E-Banking In India

Reserve Bank of India (RBI) has been playing a pro active role for securing Internet banking and online banking transactions. Recently, RBI showed its intention to boost ATM security in India. In the past, concerns have been raised from time to time for preventing online banking frauds in India by RBI.

There are many problems from which the online banking or Internet banking in India is suffering. The most important pertains to maintaining effective cyber security for banking and financial sectors of India. Similarly, there are no effective Internet banking laws in India or online banking laws in India. In the absence of stringent laws in this regard, online banking risks in India are increasing. However, of all the shortcomings, nothing can match the absence of encryption laws and standards in India. In the absence of proper encryption norms in India, e-banking in India is really insecure.

RBI has realised this fact and it has cautioned banks that e-banking must be used by them with proper security and safeguards. “The use of e-banking has brought many concerns from different stakeholders. Everybody’s primary concern is security. As more and more people are exposed to the information superhighway, privacy of information and the security that goes hand and hand with this information is crucial to the growth of electronic transactions,’’ said R Gandhi, executive director , Reserve Bank of India.

Gandhi said in order to provide effective and secure banking transactions, there are four technology issues that need to be resolved. “The key areas are the security, privacy and authentication,” he said. By strengthening the privacy technology, this will ensure the secrecy of sender’s personal information and enhance the system’s security. “Also encryption may help make the transactions more secure, but there is also a need to guarantee that no one alters the data at either end of the transaction,” Gandhi said.

Recently, G Gopalakrishna, the executive director of RBI, said that all Banks would have to create a position of Chief Information Officers (CIOs) as well as Steering Committees on Information Security at the Board Level at the earliest, informs Praveen Dalal, managing partner of New Delhi based ICT law firm Perry4Law and leading techno legal specialist of India. This step was taken to ensure proper Cyber Security Policies and Strategies at the highest Board Level of Banks, says Dalal.

Although, RBI has been taking many far reaching and important steps yet e-banking in India still very risky. Of late, cases of phishing and banking frauds have increased tremendously in India. Further, cyber due diligence of banks in India is still a far dream. Even the directions of RBI to appoint CIOs and steering committees on information security have not yet been implemented. The end result is that banking customers are still losing their hard earned money to cyber criminals. Hopefully, RBI would take some urgent steps in these directions as soon as possible, says Praveen Dalal.

Increasing Cyber Security Readiness With Adaptive Threat Management

Cyber security in India has yet to take a good start. There are many factors that ail cyber security of India. This is primarily due to that fact that we have no cyber security policy and strategy in India. Without a cyber security policy, cyber security cannot grow in India.

Cyber security is not only essential for safeguarding national cyber assets but also for securing private assets of individuals and corporations. This is the reason why much importance should be given to cyber security initiatives in India.

Cyber security must also be seen as a sound business strategy. When organisations and businesses are connected to always on networks and Internet, it is of great business value that such computer systems must be strongly secured from cyber attacks, says Praveen Dalal, managing partner of New Delhi based Law Firm Perry4Law and CEO of exclusive techno legal cyber security research, training and educational centre of India. Even a temporary shut down of such crucial business computers may have significant business losses, opines Dalal.

Recently, the Reserve Bank of India (RBI) reiterated the importance of cyber security for banking and financial sectors of India. RBI has declared that all banks would have to create a position of chief information officers (CIOs) as well as steering committees on information security at the board level at the earliest. RBI also mandated cyber due diligence for banks in India.

Companies and business houses must understand the importance of increasing cyber security readiness and corresponding adaptive threat management, opines Dalal. They must understand the importance of e-discovery practices, incidence response, first responder’s roles, cyber due diligence, etc. If these companies and business houses have a sound e-discovery mechanism, good cyber security readiness model and adaptive threat management policy, many frauds can be anticipated and prevented before they occur, suggests Dalal.

India has to cover a long gap before it can ensure cyber security readiness and adaptive threat management. With the help of cyber security research centre of India not only suitable cyber security polices for India can be formulated but good cyber security readiness can be ensured.

Steering Committees On Information Security By Banks In India

Cyber crimes have increased a lot in India. Cyber crimes have not left any field or commercial activity untouched. Even the banking sector has not remained unaffected by cyber crimes. Further, the cyber law of India has introduced its own set of due diligence requirements for banks operating in India.

Realising the gravity of the situation, the Reserve Bank of India (RBI) has recently released a report of its working group on information security, electronic banking, technology risk management, and cyber frauds. In this report, the RBI mandated cyber due diligence for banks in India.

The matter does not end here. It is clear that RBI has to meet great challenges before Indian banking industry can be considered reasonably safe from cyber criminals. This is more so when we have inadequate cyber laws and other laws to effectively tackle cyber crimes pertaining to banking sector of India.

Internet banking is increasingly becoming popular in India. However, Internet banking is a risky venture and India must be prepared to deal with the risks associated with it. The increasing cases of ATM frauds, online banking frauds, credit cards frauds, etc have shaken the confidence of Indian consumers in Internet banking in India.

However, Internet banking in India cannot succeed till a strong legal framework in this is enacted. According to Praveen Dalal, leading techno legal expert of India and a Supreme Court lawyer, we have no dedicated Internet Banking Law in India. Although, RBI has issued many guidelines in this regard and even our Information Technology Act, 2000 contains some indirect and implied provisions for Internet Banking yet we need a separate and dedicated law in this regard, opines Praveen Dalal.

Similarly, the present banking and other technology related legal frameworks are not conducive for mobile banking in India. We do not have a well developed e-governance infrastructure in India. Similarly, on the front of e-commerce as well, India is not much successful.

In this background, the requirements of cyber due diligence of banks in India has become more onerous. RBI has further made this requirement absolute through its Information Technology Vision Document 2011-17. According to this policy document, all banks now would have to create a position of chief information officers (CTOs) as well as steering committees on information security at the board level at the earliest.

The presence of CTO and steering committees on information security would ensure that banks are following cyber due diligence and other technology and non technology related due diligence requirements in India, says B.S.Dalal, a banking and financial law expert and senior partner of Perry4Law. Till now there was no such requirement and banks were taking cyber law related issues lightly. RBI has taken a good step in right direction and this would increase the confidence of bank customers of India.

Internet Banking Laws In India

Internet banking is increasingly becoming popular in India. However, Internet banking is a risky venture and India must be prepared to deal with the risks associated with it. The increasing cases of ATM frauds, online banking frauds, credit cards frauds, etc have shaken the confidence of Indian consumers in Internet banking in India.

Similarly, mobile banking in India is also being explored. Some segments have suggested active use of mobile banking in India. While the idea is great yet India is still not ready for mobile banking. In fact, mobile banking in India is a risky business.

The problem of Internet banking frauds has become even more sever due to absence of legal framework in this regard. However, the Reserve Bank of India (RBI) has recently recommended use of “cyber due diligence” for banks in India. With the present guidelines, banks can no more ignore due diligence requirements that they have been ignoring for long.

Although the requirements of due diligence may arise out of many laws, but cyber due diligence is the most required one. Realising the seriousness of the situation, RBI has recently released a report of its working group on information security, electronic banking, technology risk management, and cyber frauds.

Previously, banks were required to manage due diligence arising out of laws alone but now the responsibility of banks have become very wide. The banks must now manage due diligence requirements of both technical and legal nature. In other words, the due diligence requirements of banks have now become techno legal in nature.

However, Internet banking in India cannot succeed till a strong legal framework in this is enacted. According to Praveen Dalal, leading techno legal expert of India and a Supreme Court lawyer, we have no dedicated Internet Banking Law in India. Although, RBI has issued many guidelines in this regard and even our Information Technology Act, 2000 contains some indirect and implied provisions for Internet Banking yet we need a separate and dedicated law in this regard, opines Praveen Dalal.

It would be a good idea if RBI starts working in the direction of enacting a suitable Internet banking law of India. The same may also incorporate cyber due diligence requirements and punishments for cyber crimes against banking institutions. The call is for the RBI to take and it would definitely take it.