[shipnil]

Originally Posted by alpha1

So last week I was conned due to the great "tap" feature of our credit cards.
Received two SMS about 30 minutes afterwards that Rs 2000 and Rs 4400 have been charged on my credit card.

I am always distrustful of such features hence I had reduced the max limit to 1000 for tap feature when I received the card. But then what I have observed with my HDFC is the SMS comes immediately if "Tap" is used, even before I leave the shop. Same is not the case when PIN is required to be entered on a swipe. May be this is a feature to reduce the cases like you experienced.

[binand]

Originally Posted by alpha1

So last week I was conned due to the great "tap" feature of our credit cards.

I actually love these NFC payment ("tap to pay"). It is all the vogue throughout the UAE and is such a time-saver. I am somewhat disappointed that it doesn't see a lot of uptake in India despite everyone upgrading to compatible cards and PoS machines.

Originally Posted by alpha1

Anyhow, what happened is that the petrol pump attendant took my card...

You got cheated because you allowed the card to be taken away from your hand and out of your sight. This is a no-no taught in card handling 101.

[whitewing]

Originally Posted by alpha1

Received two SMS about 30 minutes afterwards that Rs 2000 and Rs 4400 have been charged on my credit card. Presumably, the rascal keyed Rs 2000 and tapped the card, made an excuse of faulty machine and charged Rs 4400 on the other machine.

Tap enabled cards should be handled only in your presence. Even if it means following the attendant to the swipe machine.

In any case, to deprive the crook of his gains, I hope you have raised a request to dispute/reverse the transaction by calling the customer care?

[ronford]

Received two SMS about 30 minutes afterwards that Rs 2000 and Rs 4400 have been charged on my credit card. Presumably, the rascal keyed Rs 2000 and tapped the card, made an excuse of faulty machine and charged Rs 4400 on the other machine.

Which bunk in Pune was this?

[alpha1]

Originally Posted by binand

I actually love these NFC payment ("tap to pay"). It is all the vogue throughout the UAE and is such a time-saver. I am somewhat disappointed that it doesn't see a lot of uptake in India despite everyone upgrading to compatible cards and PoS machines.

How much time do you save by not keying in the PIN? 5 minutes per transaction? Really - or is it 5 seconds?

In fact I was alarmed in the US - there is no provision of PIN or OTP or anything vaguely enhancing customer's transaction security there.
Do you by any chance also support the no-PIN policy of US?

You got cheated because you allowed the card to be taken away from your hand and out of your sight. This is a no-no taught in card handling 101.

Binand, you must remember that credit cards (and debit cards) in India are primarily used with PIN only. Even when the attendant turns his back to you for a second, he will have to come to face you to enter the PIN.

But with TAP technology he can do mischief in that second he has his back to you. It will require an experience to understand that it is so easy to get conned.

In any case, my post is meant to make people aware, that such con-friendly technologies are prebuilt and enabled by default into everyone's card these days and the onus is on us to manually disable them. (Which I have done for all my other cards)

Originally Posted by ronford

Which bunk in Pune was this?

Actually I have shifted to Mumbai - This pump was in Mumbai Andheri West - but still too far away from my home (20 km) to go and fight with the bunk owner.

Yeah I have flagged this as fraudulent transaction as soon as I received the sms.

[binand]

Originally Posted by alpha1

How much time do you save by not keying in the PIN? 5 minutes per transaction? Really - or is it 5 seconds?

In fact I was alarmed in the US - there is no provision of PIN or OTP or anything vaguely enhancing customer's transaction security there.
Do you by any chance also support the no-PIN policy of US?

If you are in a long queue, and everyone ahead of you saves maybe a minute - it all adds up. And I do support the policy of not requiring a PIN for small ticket sizes. It is all about the risk-reward calculation - which the rulemakers must allow the adults to do. I am actually quite sick of RBI deciding for me how I should use my card.

Originally Posted by alpha1

Binand, you must remember that credit cards (and debit cards) in India are primarily used with PIN only. Even when the attendant turns his back to you for a second, he will have to come to face you to enter the PIN.

Nobody apart from my wife has handled any of my credit cards for years. Where it has to be inserted into a PoS machine, I do it myself. With or without PIN.

Btw, I'm totally with you on the awareness part. That NFC payments is a thing and works in India needs to be better known.

[Mahesh Babu]

Originally Posted by alpha1

So last week I was conned due to the great "tap" feature of our credit cards.
I was reluctant at the inception of this stupid technology and the fraud has only bolstered by beliefs.
Why are we so lazy to even punch in the PIN?

I have realized only after the fraud that all cards come BY DEFAULT with this feature and you need to manually disable it (via portal/app/customer care).

My impression was that the "Tap" was a safer option considering the fact that we are under camera surveillance while using the card. It is quite possible for them to get our card details from a good resolution camera and keying in the pin, especially with the latest onscreen jumbled numbers instead of old style keypad, is making us very vulnerable. What if we ourselves handle the card for tapping rather than letting them do it, will it not nullify the risks involved?

[thanixravindran]

Originally Posted by alpha1

In any case, my post is meant to make people aware, that such con-friendly technologies are prebuilt and enabled by default into everyone's card these days and the onus is on us to manually disable them. (Which I have done for all my other cards)
.

Are you sure about this as I thought due to RBI regulations, all online, Tap and international transactions are disabled by default for both new credit and debit cards since last couple of years.

https://m.rbi.org.in//Scripts/Notifi...d=11788&Mode=0

For older cards, I agree one has to manually disable them.

[kavensri]

Originally Posted by vinu_h

Interesting move by SBI.

I had applied for this card on 2nd. Today a representative came home for verification. I am surprised that they are still following the old school verification method (by meeting the customer personally) when most of the private banks have moved completely to e-KYC.

[binand]

Originally Posted by kavensri

most of the private banks have moved completely to e-KYC.

Is that correct? As far as I'm aware (Aadhaar+OTP based) e-KYC can be used only for bank accounts with a number of limitations - in particular such customers are not eligible for credit cards and have to do the full KYC within a year or risk account closure.

[UPS_Guru]

Originally Posted by binand

...e-KYC can be used only for bank accounts with a number of limitations...not eligible for credit cards...have to do the full KYC within a year or risk account closure...

These days eKYC + video verification of live person + PAN Card is equal to full KYC. IDFC and ICICI banks follow this process.

[binand]

Originally Posted by UPS_Guru

These days eKYC + video verification of live person + PAN Card is equal to full KYC. IDFC and ICICI banks follow this process.

Thanks. Found the relevant RBI circular. It is optional on banks though (and has somewhat onerous infrastructure requirements).

[kavensri]

Originally Posted by binand

Is that correct? As far as I'm aware (Aadhaar+OTP based) e-KYC can be used only for bank accounts with a number of limitations - in particular such customers are not eligible for credit cards and have to do the full KYC within a year or risk account closure.

I recently opened an SB account with SBI for my daughter. Everything was done online. Before that I had opened HDFC SB account also through online. And my friend recently opened an SB account with IDFC through online again. So, I was expecting that even SBI CC would be online.

[binand]

Originally Posted by kavensri

I recently opened an SB account with SBI for my daughter. Everything was done online. Before that I had opened HDFC SB account also through online. And my friend recently opened an SB account with IDFC through online again. So, I was expecting that even SBI CC would be online.

Yes, SB accounts with certain limitations can be opened in a purely no-contact manner over the Internet with Aadhaar+OTP. RBI explicitly allowed this a few years ago. But such accounts are severely restricted in functionality both by RBI and bank's own policies.

I wasn't aware of a 2021 circular that provided the policy framework for V-CIP (Video-based Customer Identification Procedure) that banks can use as part of their KYC.

[kavensri]

Originally Posted by binand

Yes, SB accounts with certain limitations can be opened in a purely no-contact manner over the Internet with Aadhaar+OTP. RBI explicitly allowed this a few years ago. But such accounts are severely restricted in functionality both by RBI and bank's own policies.

I have not come across any limitations with my HDFC SB account (more than 2 years now) or with my friend's IDFC SB account (more than an year). And same with my daughter's SBI SB account (couple of months) as well. All the 3 accounts were opened through e-KYC method.
But so far, I have not come across CC being issue by any bank through e-KYC method. I stand corrected in this regard.