Indian banks not yet ready to issue EMV standard cards

Credit/debit card skimming is one of the major concerns of the financial industry's and often results in forms of identity theft, credit card fraud or bank fraud. The magnetic stripe credit and debit cards store a user's financial data in static format. This data is vulnerable to be copied during offline transactions by skimming devices, which can be used to create a clone card and make unauthorized offline transactions.

Following a surge in credit card frauds in the country on the account of cards being lost/stolen, data being compromised and cards skimmed/counterfeited, the Reserve Bank of India issued a directive to Indian banks to move to the EMV standard by June 30 of this year.

The RBI guidelines doesn't say that all the customers debit/credit cards need to be replaced with the EMV standard cards, says B R Bhat, CIO, Corporation Bank. He adds that Corporation Bank will start issuing EMV cards only to customers who have done international transaction in past one to two years.

"We have issued 10 million debit/credit cards and all these can't be replaced at one go," Bhat says. "The cost of issuing a EMV card is five times higher than Master/Visa Card, which has to be borne by the banks." He adds that transferring money to a foreign country from India, doing e-commerce translation, does not constitute an international transaction. An international transaction is one if a debit/credit card has been used in a foreign market.

A Surendran, Head- Retail and International Banking, Federal Bank says that bank will initially, replace all the magstripe cards that have been used for international transaction with EVM chip based cards. Hereafter, new cards issued for international usage will also be chip based. If any customer prefers to upgrade from the magstripe card to EMV chip based cards, their requirement will be met. Replacing all magstipe cards with EMV chip cards will be examined based on the additional security and convenience features the cards will be providing to customers.

In order to benefit from EMV, and avoid skimming and fraud, the debit/credit cards need to be upgraded to an EMV chip card from the regular magnetic strip cards. At present, a majority of banks in India have already started issuing EMV chip cards to their third party payment gateway, says Hon Kuan Lee, regional director of Gemalto, a digital security company that helps banks in migrating to the EMV standard.

The success of the migration exercise is exemplified by the case of Malaysia, which fully converted to EMV chip ATM cards by end-2005. Card fraud was reduced by 85 per cent from $5.9 million in 2003 to $0.3m in that year alone.

Lee adds that the RBI has been working toward putting in place a system to make both credit card and debit card transactions safer. With its latest directive for banks and financial institutions to migrate to the EMV technology by June 30, 2013, RBI is pushing banks to implement safety measures and eliminate cases of fraud, thereby ensuring secure transactions.

The National Payments Corporation of India (NPCI) is emerging as the infrastructure provider for the banking system. Its entry has enabled bank accountholders free usage of any ATM in the country. Its Rupay card promises to save the country foreign exchange paid out to multinational giants as service charges for card payments. It is also providing the technology backbone for direct cash transfer which will replace government subsidies. In an interview with TOI, NPCI MD & CEO A P Hota speaks of how the payment landscape will evolve.

Our main achievement is that we are "cardifying" customers of those banks who have never seen a card. Until Rupay came hardly 50-60 banks were issuing cards. Now the number of banks issuing cards is 106. We plan to reach out to 500 to 600 banks in a year for issuance of cards. Out of 58 rural banks, 50 have started issuing Rupay cards which can be used in any ATM or for retail payments and ecommerce.


Of the 9 lakh point of sales (POS) terminals, 2.10 lakh are active on Rupay. Three banks—HDFC Bank, ICICI Merchant Services and Axis Bank—account for 80% of POS terminals in the country. We are talking to all three. We expect that 90% of the terminals would be active by September-end. Among public sector banks, SBI is the largest and we have already activated 85,000 of their POS machines. In e-commerce, we have made a beginning by tying up two banks out of 17. We are targeting the remaining. There are about 12,000 merchants in online space and we are working to get them to accept Rupay. Merchants will have to make a small change of providing one more link to Rupay payments.

This 1.4 million number has been arrived at by calculating two terminals per village for each of the six lakh villages in the country and remaining two lakhs for the cities. The micro ATMs are similar to point of sales terminals with biometric authentication. Under the UIDAI scheme, banks would be reimbursed cost of the terminals to the extent of Rs 15,000 the moment they reach 2000 transactions. The financial support is linked with the volume of transactions. Nabard has said that it will provide Rs 25,000 per terminal if they are set up by rural banks. Regional rural banks (RRBs) are dependent on sponsor public sector banks. This gives an opportunity to PSU banks to leverage RRBs to reach out to rural areas for financial inclusion.

There seems to be some debate over whether cards should have chip-and-pin based authentication or Aadhaar-based biometric authentication?

It is not debate between Aadhaar and chip and pin. The market is very large and the potential of Aadhaar is in taking needs of another segment. If everyone has to move to cashless transaction in a secure mode that will need the coexistence of both. As against average cost of Rs 20 for a magnetic stripe card, the cost is around Rs 80 for a chip card. For financial inclusion, Aadhar is a better option because in villages maintaining the confidentiality of PIN is difficult as this would require a certain degree of understanding of the risk associated with it.

There have been a number of frauds in ATMs of late. As their network provider what are you doing to cut frauds?

We are asking banks to go in for fraud-risk mitigation (FRM) system. FRM system is a neural system that can identify suspect transactions. RBI has also recommended that banks should put in closed circuit cameras in all ATM locations. But because cloning has become so easy, sooner or later the country will have to migrate to a chip and pin or Aadhar based authentication.

There are over 5 crore accountholders registered for IMPS (instant mobile-based payment service). When will the usage take off?

If IMPS has to cover everybody it is possible only if usage goes beyond those with smartphones. It needs to cover Rs 1,000 handsets as well. For such handsets, the only option is SMS or USSD. But SMS is unsecure as the PIN is exposed so the best system is a server-based one. So USSD is the answer. But this requires partnership with telecom companies. The telcos want bank to pay charges on behalf of customers, but if banks do this tomorrow there may be a demand from customers that bank pay data charges for mobile and internet.

Click on their website austpay.com for more information.