RBI for Aadhaar authentication on card-based transactions

In order to ensure security in card-based payment transactions taking place at point of sale (POS) terminals or ATMs, the Reserve Bank of India (RBI) has advised banks that they may adopt Aadhaar as additional authentication or move to EMV (Euro pay MasterCard Visa) chip-and-pin technology.

"In respect of cards, not specifically mandated by the RBI to adopt EMV norms, banks may take a decision whether they should adopt Aadhaar as additional factor of authentication or move to EMV chip-and-pin technology for securing the card present payment infrastructure," the apex bank said in a notification on Tuesday.

However, it said all new card-present infrastructure has to be enabled with both EMV chip-and-pin technology as well as Aadhaar.

Biometric (finger print/retina scan) captured by UIDAI can be used as authentication to protect against both domestic counterfeit, and lost and stolen card fraud, as the cardholder has to be physically present at the POS terminal/ATM to authenticate the transaction.

Even if the card is counterfeited, the fraudster will not be able to use the card as biometric of the customer would be required.

For securing card and electronic payment transactions, the RBI had set up a working group that had recommended evaluation of UIDAI's Aadhaar as an effective alternative for additional factor of authentication for domestic transactions.

The RBI said the recommendations of the Working Group have been examined and these have been advised after taking into consideration the developments that have taken place in the card payment ecosystem as well as the scalability and effectiveness of Aadhaar over a period of time.

Card-present transactions, in which the cardholder is required to be physically present, at POS or at ATMs constitute the major proportion of card based transactions in India.

At present, transactions using cards at POS do not require additional authentication in majority of the cards.

However, data stored in magnetic stripe is vulnerable to skimming. Increasing confidence of the customer for using POS channel would require securing of these transactions through implementation of authentication in the short run and prevent counterfeiting of cards by migrating to chip and PIN in the long run.

EMV chip card protects against counterfeit (skimming) card fraud. EMV chip card and PIN protects against counterfeit (skimming), and lost and stolen, card fraud.