Monday, July 27, 2009

RBI for implementation of guidelines for online card use from August 1

The Reserve Bank of India (RBI) has tightened online card use. Regarding this RBI had issued guidelines this year in February according to which it is mandatory to have additional authentications/verifications based on information about the card-holder that is not mentioned on the card. It is believed this will help in curtailing online card fraud.

It has been five months and till now the banks have not started updating their systems to acclimatize this change. One of the ICICI bank credit card holder informed, “My bank has not contacted me about any additional requirement”.

On the other hand banks say it is the responsibility of the customers to register themselves for a new password on their bank’s websites or activate this service to do online shopping.

The Indian e-commerce players fear drop in their business as they get 80% of the business from the use of credit cards. Although they admit that from August 1 the online shopping for India’s 24 million-odd online credit card and 140 million debit card users will become safe but also have fear that there will be approximately 30% decline in business due to inclusion of additional authentication step and also the banks have also not done any up gradation on their part.

Even the customers such as Anand Sharma (not his real name) who is proficient in online shopping is also not aware that from August 1 he along with his 16-digit credit card number, card expiry date and 3-digit CVV number (on the back of the card) also have to enroll his card with VBV (Verified by Visa) or MSC (Mastercard Secure Code) to complete a transaction to buy something online.

Anupam Mittal, chairman and managing director, People Group said though he is in favor of additional security measures but e-commerce players will be loosing revenue of around Rs 2,500 crore. He stated, “As a result, the exchequer may stand to lose up to Rs 300 crore in service tax”.

P K X Thomas, COO of Cleartrip.com, informed, “On cleartrip.com, when users were redirected for 3-D secure authentication, we noticed a 25 to 35 per cent drop in payment completion rates.”

Out of the large number of Cleartrip customers around 45 per cent of them doing transaction by credit card on its website are Visa card holders. While 34 per cent are Master card holders, followed by netBanking, debit cards, cash cards and Amex credit cards.

An eBay India spokesperson pointed out the move to be “neutral to positive”. She said it would customer’s responsibility to recall that extra password.

In the meantime the Internet & Mobile Association of India (IAMAI) has requested the RBI for the extension of the deadline by 60 days. A memorandum sent by the association stated, “We believe the major banks have registered less than 40 per cent of their active base, despite active advertising by all our major members to their customers”.

According to association the directive may end up being the biggest disincentive to India’s promising e-commerce business rather than an enabler.

Association stated as per information online fraud is just 0.16 per cent of the e-commerce industry in India and is not placed in the top 10 online fraud-perpetrating countries. According to the Internet Crime Complaint Center (IC3) report the US and UK has the largest online fraud-perpetrators.

Usage of international cards is primarily responsible for the online card frauds the Indian cards contribution is very less in percentage, moreover these cards will not be controlled by this directive, thus the Indian card user have little respite from online card fraud and even with the directive, IAMAI pointed out.

Subho Ray, President, IAMAI also said that in India in the e-commerce environment the banks are merely payment enablers therefore the merchant site has to bear the risk arising from non-payment or fraud and not the banks and the card companies Visa and Master. He added it is the online merchants who are already facing problem will have to face serious implications of the implementation of these guidelines.

In the international countries where there is much larger e-commerce markets than India and also high rate of online card frauds like the US and UK have not implemented any mandatory requirements for additional verifications like the one RBI is proposed to do, such practices are best as recommendations, Ray pointed out.

On the other hand ICICI Bank spokesperson informed the bank has already started corresponding to its customers about the importance of these guidelines through statements. She added, “We will be soon sending out SMS alerts and emails to our entire base. We will also be using the print media to educate all online customers (irrespective of bank) of the need and process to register and make online transactions safe and secure”. In India ICICI Bank has the largest base of about 7 million credit cards.

Other large card issuers of the country have speed up their efforts to certain they are complaint with the new directive. SBI Cards, a joint venture between GE Capital and State Bank of India (SBI), pointed out now only those transactions are processed which are verified by a separate password. SBI Cards are having 3 million credit cards.

A bank spokesperson explained now it is mandatory for customers to create a password that they will have to enter when transacting online. SBI Card has implemented these measures from July 1.

While the customers have been given some flexibility and can carry out up to three transactions without a password. In case of foreign banks most of the lenders including Citibank have already made mandatory for the customers to have an I-PIN to use their credit cards to do online transaction.

No comments: