India’s bank frauds need a sensible response

By Andy Mukherjee

Bank frauds in India have tripled in value. But that’s only because some of the cases reported previously were reinvestigated and appeared in the new data. More worrying than the surge in the amount, however, is the rise in the number of payment scams over the past couple of years. The solution lies in rewarding better security.

Most of the stealing from banks occurs the traditional way: via loans obtained with the help of forged documents or bribes. Customers, though, are increasingly at risk of being cheated when they make payments. According to the RBI’s latest annual report, more than half of frauds took place in digital or card-based transactions, even though they accounted for only 1.4 per cent of the $4 billion in scams.

And these are just the situations where the sums involved were 100,000 rupees ($1,160) or more. Thanks to a wildly popular smartphone-based payments network, much smaller values are being exchanged online for person-to-person and person-to-merchant transactions. The so-called Unified Payments Interface is instantaneous, available 24/7 and mostly imposes no cost on users.

It’s logging more than a million cases of hustle and con annually, according to separate government data. And this is just what’s getting reported. Unless they are extremely careful, the more affluent depositors don’t even come to know that they’re being slowly bled.

The growth of the UPI, which handles more than $3 trillion a year, puts enormous pressure on the system. It was bound to attract criminals. Payment intermediaries have warned customers of the various ways — from simple phishing attacks to sophisticated cloning of SIM cards — in which they may fall prey to swindlers.

Yet the banking system can’t shrug off its responsibility with a “buyer beware.” It needs stronger guardrails. Anyone can set up a virtual ID to ask customers for money online. That freedom is welcome. But not when it turns out that the bank account linked to “amazon@pockets” belongs to Ckjxh Fiddbh, which doesn’t appear to be a real name. (The example, though, is real, cited in security researcher Karan Saini’s investigation.)

Payment frauds happen everywhere. Brazil’s PIX, which ranks alongside India’s UPI as among the fastest-growing account-to-account transfer systems worldwide, is notorious for its “PIX gangs.”

What makes India’s case problematic is that scamsters have learned to coexist alongside a vast digital identity database, a biometrics-based unique number and card through which 1.4 billion people establish who they are. It hasn’t stopped identity theft. India’s banks are constantly bombarding customers with “know-your-customer” checks, asking for the same documents again and again. Yet “mules” continue to thrive. Accounts of unsuspecting customers are used by, among others, online bookmakers located overseas to provide illegal access to casinos and cricket betting via cryptocurrencies.

The Reserve Bank of India’s innovation hub has come up with an artificial-intelligence tool called “MuleHunter.ai.” It’s now building a prototype for an intelligence platform covering all digital payments. However, it isn’t enough to merely identify suspicious transactions. As analysts have pointed out, the local money-laundering laws do not allow banks to take prompt preventive action, or to restore funds to their rightful owners.

Critical sectors of the economy can’t wait for legal changes. The stock-market regulator has decided to add a layer of security to investment funds changing hands online. From October, a @valid suffix on virtual payment handles will be mandatory for brokers, investment advisers, research analysts, merchant bankers, and mutual funds to collect payments from investors.

These are all stopgaps. Ultimately, New Delhi must put the payment industry on a sustainable footing. Five years ago, it decided that UPI transfers to merchants should be free for users to encourage digitisation. The goal has been realised. Although the government denied just last week that it has any such plans, it’s time to allow banks and apps like Google Pay and PhonePe to recoup their costs.

In fact, the National Payments Corporation of India, the public monopoly that runs the network, should now face competition. Let private operators charge a basic transaction fee to offer institutional-grade security.

The government can maintain its explicit incentives to promote low-value cashless payments at the bottom of the economic pyramid. As for other customers, a high-volume, competitive market would keep a lid on fees, while offering them greater peace of mind.

Banks will also heave a sigh of relief. Payment is a utility they must provide to depositors so they have the liquidity to lend. Frauds are becoming a costly distraction.