[amitk26]

Folks I have a situation at my hand and a question.

I made a payment for my ICICI bank CC yesterday ( 6th feb) using click to pay at around 13:50 PM using my Citibank debit card . Now this is not yet reflected in ICICI card statement.

I checked the transactions of my Citibank and there is a line statement for this payment. I see transaction date/time a reference number and then a card number where few digits are masked but the card number is actually my Citibank debit card number and not ICICI bank Visa CC.
Seeing this a chill run down my spine does it mean that by mistake I entered my own debit card number and money has gone to someone's VISA credit card bearing same number as my Citi debit card ?
Now if I have done this it will be my stupidity and carelessness and no one is to blame

I called up ICICI CC department they do not see this transaction and neither can they trace using reference number to which ICICI bank CC account this money went .

Citibank Call center says allow 48 hours the number is debit card number and they do not know to which CC this money is transferred as reference number if of ICICI.

So best case is that whatever Citibank says is right and in 48 hours amount gets reflected.

But does this mean that there is no way to trace where money went once transaction is over ? What is the use of transaction reference number in that case ?

[Recompose]

Originally Posted by amitk26

I checked the transactions of my Citibank and there is a line statement for this payment. I see transaction date/time a reference number and then a card number where few digits are masked but the card number is actually my Citibank debit card number and not ICICI bank Visa CC.
Seeing this a chill run down my spine does it mean that by mistake I entered my own debit card number and money has gone to someone's VISA credit card bearing same number as my Citi debit card ?
Now if I have done this it will be my stupidity and carelessness and no one is to blame

No, it is not possible for another VISA credit card to bear the same number as your Citi debit card. What's surprising is that the payment went through as AFAIK, the first 8 digits represent the bank code and region. Since they're obviously going to differ for ICICI and Citi, the payment shouldnt have processed.

I'm sure Citi will be able to resolve the issue at their end - after all, the money debited from your account went to your own.

[sa_kiran]

Originally Posted by amitk26

I checked the transactions of my Citibank and there is a line statement for this payment. I see transaction date/time a reference number and then a card number where few digits are masked but the card number is actually my Citibank debit card number and not ICICI bank Visa CC.

First of all, I've say that ICICI Bank's Click to pay is very lousy. Why did it accept payment for a card that does not belong to ICICI Bank? Citi debited your account and sent the amount to ICICI Bank. ICICI Bank should reject the transaction and send an appropriate response, may be it will take 48 hours. In the meanwhile, make a correct payment, to avoid late payment charges and interest.

[k2max6]

Originally Posted by amitk26

Folks I have a situation at my hand and a question.

I made a payment for my ICICI bank CC yesterday ( 6th feb) using click to pay at around 13:50 PM using my Citibank debit card . Now this is not yet reflected in ICICI card statement.

I checked the transactions of my Citibank and there is a line statement for this payment. I see transaction date/time a reference number and then a card number where few digits are masked but the card number is actually my Citibank debit card number and not ICICI bank Visa CC.
Seeing this a chill run down my spine does it mean that by mistake I entered my own debit card number and money has gone to someone's VISA credit card bearing same number as my Citi debit card ?
Now if I have done this it will be my stupidity and carelessness and no one is to blame

I called up ICICI CC department they do not see this transaction and neither can they trace using reference number to which ICICI bank CC account this money went .

Citibank Call center says allow 48 hours the number is debit card number and they do not know to which CC this money is transferred as reference number if of ICICI.

So best case is that whatever Citibank says is right and in 48 hours amount gets reflected.

But does this mean that there is no way to trace where money went once transaction is over ? What is the use of transaction reference number in that case ?

In the first case the payment application verifies the credit card number entered. I don't know specifically about the means you have used though. But all payments processed through billdesk give an error in case of a wrong card number. So should click2pay. If it was ICICI's click2pay it would pop an error incase a non icici credit card number is entered.

Secondly,As far as i know VISA card numbers are unique.

It may take upto 48 hrs for the money to be credited to your ICICI CC A/c.

You should have got a receipt when the payment was completed. It generally has the last 4 digits of the card number.

In any scenario the money is safe

[amitk26]

Originally Posted by k2max6

Secondly,As far as i know VISA card numbers are unique.

It may take upto 48 hrs for the money to be credited to your ICICI CC A/c.

You should have got a receipt when the payment was completed. It generally has the last 4 digits of the card number.

In any scenario the money is safe

Originally Posted by Recompose

No, it is not possible for another VISA credit card to bear the same number as your Citi debit card.

Thanks a lot guys relieved to hear this and I love team-bhp

Originally Posted by sa_kiran

In the meanwhile, make a correct payment, to avoid late payment charges and interest.

Thanks a lot there are still couple of days left so I think I will first wait for this 48 hours to get over and then make payment if required.

[RajeshK]

Looks like there is a big gang behind this fraud.... I also fell victim of these people, my card was swiped in Canada for 150 CAD while I am sleeping peacefully in my home at Bangalore and my card is with me intact..!!! http://timesofindia.indiatimes.com/b...w/18374002.cms

[binand]

Originally Posted by speedmiester

Please be careful when you use your credit card. It is always advisable to use a credit card with an embedded chip.

That's what the bank wants you to believe. Then they can wash off their responsibility and say, "you had an unbreakable chip card, so whatever happened is all your fault" (and if they can charge you extra in the bargain, it will not hurt). Don't fall for it. The chip card still contains the magnetic strip and is still vulnerable to all fraud methods that targeted this strip.

Originally Posted by amitk26

Seeing this a chill run down my spine does it mean that by mistake I entered my own debit card number and money has gone to someone's VISA credit card bearing same number as my Citi debit card ?

Don't worry about it. Card numbers are globally unique. In fact, the first six digits of the card number signifies the bank that issued the card (Visa/MC and associated brands).

Originally Posted by amitk26

But does this mean that there is no way to trace where money went once transaction is over ? What is the use of transaction reference number in that case ?

Transactions take a while to reconcile. You need to wait this reconciliation out.

[sa_kiran]

Originally Posted by binand

That's what the bank wants you to believe. Then they can wash off their responsibility and say, "you had an unbreakable chip card, so whatever happened is all your fault" (and if they can charge you extra in the bargain, it will not hurt). Don't fall for it. The chip card still contains the magnetic strip and is still vulnerable to all fraud methods that targeted this strip.

The banks are mostly right when they say that chip cards are secure. There are no mass scale compromise of these cards. These cards also have magnetic stripe and data from that can be skimmed and used for scam. However, if any merchant accepts magnetic stripe data from a chip card, the liability shifts to merchants. Banks and cardholders are safeguarded.

[binand]

Originally Posted by sa_kiran

The banks are mostly right when they say that chip cards are secure. There are no mass scale compromise of these cards. These cards also have magnetic stripe and data from that can be skimmed and used for scam. However, if any merchant accepts magnetic stripe data from a chip card, the liability shifts to merchants. Banks and cardholders are safeguarded.

Have you observed how most merchants accept the chip cards (in India, at least)? The salesperson will swipe the card through the device. A message will flash on the screen, "chip card". The salesperson then will insert the card in the reader slot.

But by now, if it is a compromised device, the damage is already done. The card details have been skimmed, but the merchant's transaction is done through the chip as expected.

Fraudsters need only the cardholder data. There is nothing in the card number which says "this card can be authenticated only via the chip reader". So, if the fraudster gets the data he can create a duplicate card without the chip and use it elsewhere (typically in a different country).

There are no large-scale compromise of chip cards in countries like the UK where every PoS device and every card is chip enabled. There the SoP is different - try the chip-reader first, and only then fallback to the magnetic stripe. But there are innumerable examples of Briton's (chip enabled) cards compromised elsewhere in Europe and rest of world.

[Edited to add]

For true credit card security, four things must happen:

1. The practice of embossing the card number and other details (expiry date, CVV2 etc.) on the card itself needs to stop.
2. The magnetic strip has to go away. Only chip enabled cards and readers should be available at all places in the world. There should be some user-verifiable (like ISI mark) method of assuring the integrity of the PoS device.
3. A cardholder needs to have separate, single-use only card numbers for card-not-present transactions. The physical card number should be blocked for CNP.
4. Cardholders need to be able to turn on/off (using say, mobile or a web UI) the ability to transact in non-home currency or at non-home country merchants.

Until the above happens, your credit card not really secure at all.

[sa_kiran]

Originally Posted by binand

Have you observed how most merchants accept the chip cards (in India, at least)? The salesperson will swipe the card through the device. A message will flash on the screen, "chip card". The salesperson then will insert the card in the reader slot.

But by now, if it is a compromised device, the damage is already done. The card details have been skimmed, but the merchant's transaction is done through the chip as expected.

Fraudsters need only the cardholder data. There is nothing in the card number which says "this card can be authenticated only via the chip reader". So, if the fraudster gets the data he can create a duplicate card without the chip and use it elsewhere (typically in a different country).

If a merchant swipes a chip card (if the chip is programmed correctly, this will not be allowed, there are exceptions though), then he bears the liability in case of fraud. If a fraudster has magnetic stripe data of a chip card, even then the card is not fully compromised. The issuer and cardholder have no liability (if a compromised card is used with mag stripe), the liability is with the merchant and his banker. If it is used on internet, there is 2-Factor authentication for Indian cards. If it is not used, again the merchant and his banker are liable. The purpose of shifting liabilities is to ensure that every participant is compliant to rules and mandates in place to reduce frauds.

The bottomline is that chip cards do eliminate most of the possibilities of fraud.

Payment card industry and banks are working towards reducing fraud. Banks should implement specialized fraud management solutions. The front page news of a Mumbai businessman's wife's card used in many continents would not have happened had the bank deployed a specialized fraud management solution.

[k2max6]

Originally Posted by sa_kiran

If it is used on internet, there is 2-Factor authentication for Indian cards.

As per an article in times of india
http://m.timesofindia.com/business/i...w/18374002.cms

* Dealing on foreign websites could be riskier as the 2-factor authentication mandated by the RBI (besides login and PIN) is for web businesses in India only

[swiftnfurious]

Originally Posted by amitk26

Folks I have a situation at my hand and a question.

I made a payment for my ICICI bank CC yesterday ( 6th feb) using click to pay at around 13:50 PM using my Citibank debit card . Now this is not yet reflected in ICICI card statement...

The transaction between ICICI & Citibank is NOT seamless from my experiences. Instead of an online payment between these two banks, I always prefer to drop a cheque in the ATMs, atleast 3 working days prior to the last date.

On the other hand, when I make a payment on my ICICI card from my ICICI account, it reflects in seconds!

I request / suggest you drop a Citi cheque worth Rs. 100/- in ICICI bank ATM to prevent a late fee in case the transaction does NOT work out. You just need to write your credit card number in the "Pay" field & write your Name & Mobile number at the back of your cheque & sign it too (if you have NOT done this method so far).

[binand]

Originally Posted by sa_kiran

The bottomline is that chip cards do eliminate most of the possibilities of fraud.

Unless banks (a) not have the magnetic stripe on chip-enabled cards, and (b) decline all swipe transactions made by a known chip card without exceptions, fraud will continue to happen.

- Card details skimmed from the magnetic strip.
- Duplicate card made from the details so skimmed.
- Duplicate card swiped at a merchant in a different country.

This is the most common attack vector, and the chip in its current avatar does nothing to prevent this. There might be corrective controls (like the shifting liabilities etc. that you point out) but none of those prevent fraud. Fraud will continue to happen, and someone in the chain has to foot the bill. Which will not be the bank, ever.

The cardholder can tell the salesperson in advance that it is a chip card, so don't swipe. Enforce this as a rule. It helps.

[k2max6]

Originally Posted by swiftnfurious

The transaction between ICICI & Citibank is NOT seamless from my experiences. Instead of an online payment between these two banks, I always prefer to drop a cheque in the ATMs, atleast 3 working days prior to the last date.

On the other hand, when I make a payment on my ICICI card from my ICICI account, it reflects in seconds!

I can't comment on the transaction smoothness when payment is made for an ICICI credit card using a citibank account.

But for vice-versa transaction is very smooth. I have been making payments for mine as well as my mother's citibank cc for approximate 3-4 years now using Citibank E-Pay( Basically transactions are processed through billdesk).
I make the payment every month and haven't faced a problem once.

I follow the same procedure for Standard Chartered, HDFC and SBI Card.

Payment is updated within a max of 48 hrs.
In case the CC and the bank account belong to the same bank, credits are instant.

[mobike008]

For the first time, I swapped my reward points of HDFC Credit Card which is in excess of 15,000 points for food vouchers

I traded approximately 6300 points for the following :-

Rs.100 X 10 vouchers of Domino Pizza = Rs.1000
Rs.250 X 4 vouchers of Mainland China/Sigree etc = Rs.1000

Basically Rs.2000 worth for 6300 points. Not a bad deal..eh?

I got the vouchers delivered by courier in a lightning 2 days from my online request.