Banks Re-crediting Accounts Hit By Debit Card Fraud: RBI

Reacting to India's largest debit card fraud, the Reserve Bank of India (RBI) said that the number of cards misused have been few, but added that banks are re-crediting accounts of customers where money has been wrongly debited.

The regulator met with senior bank officials, National Payment Corporation of India (NPCI) and card companies to review the fallout of a recent debit card breach on Monday.

The RBI did not throw much light on what exactly went wrong but said that it was informed on September 8 that details of some cards issued by a few banks “had been possibly compromised at ATMs linked to the ATM switch of one of the service providers.”

It added that the issue is currently being investigated by an approved forensic auditor.

On Thursday, NPCI issued a statement saying that 3.2 million debit cards across 19 banks could have been compromised. NPCI said that the problem was brought to their attention when they received complaints from a few banks that customers' cards were used fraudulently, mainly in China and the U.S., while those cardholders were in India.

“The complaints of fraudulent withdrawal are limited to cards of 19 banks and 641 customers. The total amount involved is Rs 1.3 crore as reported by various affected banks to NPCI,” the payments corporation had said.

The RBI did not share any data on the number of cards impacted by the fraud.

Banks have advised customers to change PIN, blocked payments at international locations and reduced withdrawal limits, said the RBI. It added that in some cases banks are replacing cards and re-crediting accounts of cardholders where money has been wrong debited.

“The Reserve Bank urges the cardholding bank customers that it is a good practice to change the PIN and passwords periodically and not to share them with anyone for any reason.”

The regulator also advised banks to review cyber security arrangements and implement a framework mandated by the RBI in June to minimize such instances.

As part of that framework, the RBI had asked banks to put in place a board approved cyber security policy. Banks had also been asked to put a cyber crisis management plan in place covering four aspects - Detection, Response, Recovery and Containment.

In addition, banks had been asked to share information regarding any unusual cyber-security incidents with appropriate authorities.