ATM frauds and Preventive Measures

Several Founders, Co-Founders, CXO Bankers, CXO Fintech professional & people who participated in the ePanel discussions:

Mr. Srinivasa Rao Muppaneni, Group CIO – Andhra Pradesh and Telangana State and Central Cooperative Banks
Mr. Prasad Likhite, Director-Sales ACI worldwide
Mr. Zulkernain Kanjariwala, Head of IT at Doha Bank
Mr.Charudutta Panchmatia, Senior Vice President at HDFC Bank Ltd
Mr. Ramasubramanian S, Application, Transformation, Management and Operations Head, DXC Technology
Mr. Muthu Krishnan, General Manager – Merchant Acquisition, India Transact Services Ltd
Mr. Anand Bajaj, Founder & CEO, Nearby Technologies Private Ltd
Mr. P B Prakash, Head Financial Institutions Group, Indusind Bank
Mr. Neeraj Chandra, Head of Operations & Technology, Abu Dhabi Commercial Bank
Mr. Ruchir Inamdar, Co-Founder, Quikepic Technologies Pvt Ltd
Mr. Ravi Virwani, Vice President – Rural Home Loans, Fullerton India Home Finance Company Ltd
Mr. Raj K Prasad, Head – GCC & CEO, DIFC Branch at Axis Bank
Mr. Raghu Veer Dendukuri, Product Owner, Intandemly
Mr. Vikas R Panditrao, Co-Founder, Forum of Industry and Academic Knowledge Sharing (FIAKS)
Many other CEO/CXO Bankers & Fintech professionals on FIAKS Forum requested to remain anonymous

The Delhi State Level Bankers’ Committee has put forth a proposal of introducing 6 to 12 hours gap between two consecutive transactions to prevent ATM frauds. Refer to the newspaper article in the same

FIAKS community member raises the following pivotal questions:

Question 1 – Firstly, is this a correct decision to prevent ATM frauds?

This type of restriction is not customer-centric and is rather saving the bank from risk by creating inconvenience to the customer.
Blocking multiple transactions may not be the best solution. In most of the cases, customers might perform two cash withdrawals back to back, post which the daily limit will get breached anyways. Most banks have daily withdrawal ceilings already. The need is to rationalize it and cover the remaining risk by insurance.
India is not a western type of economy where the card at ATM is always used by the owner. Velocity rules can identify any fraudulent transactions for that matter and can be enforced for second-factor validation. But that’s a costly solution for a bank.
From the bank’s perspective, any transaction on ATM should be correct if the PIN is correct. It’s a lapse from the customer. So, for that education plus services like a customer being able to set up withdrawal rules should be better than such time lag.
So it does not seem to be a correct proposal to prevent ATM frauds. Rather, awareness and continuous education, and intimation to customers, for big-ticket transactions/additional factor, based on non-standard transaction range help prevent frauds in general.

Question 2 – Are there better alternatives available to prevent ATM frauds?

Here’s a list of possible alternatives suggested by the community members;-

1.OTP facility: Instead of time-lag, it is better to have OTP for every ATM transaction. Criticism of OTP– There are many senior citizens who can’t read OTP and enter the same in the screen. But on the contrary, senior citizens would not do multiple withdrawals back to back anyways. Again, in the case of Off-Us transactions, no OTP and skimming will work. Below is the image denoting Canara Bank’s initiative introducing OTP facility for ATM withdrawals.

2.Biometric-based authentication: Rather considering the linkage of Aadhaar to accounts, the government can think of using the benefits of Aadhaar as it is a permanent thing, that cannot be changed, in an event of compromise/data loss. IRIS, fingerprints could work better. One more thing is that in case of going to ATM, you might have forgotten your mobile at home, but in the case of biometrics, mobile does not become a barrier.

3.Facial recognition: In this case, any user transacting should show live face and mask/cap/helmet should be detected by ATM Camera, thereby stopping the transaction. If a person is standing behind and watching the person, the system can alert the user about the presence of another person nearby.

4. Showing a random number on Bank App/ BHIM App/any UPI App, in this context, that needs to be selected on the screen, may help a bit, similar to Gmail Login Check (that verifies whenever Gmail account is logged in from a public computer)

5, While Magnetic Stripe Cards are being discontinued, mandating UPI for withdrawals is another solution, wherein, instead of choosing the received random number, they will enter UPI PIN, and authorize the transaction, so cash withdrawal gets completed. Watch this video shared by the community member