E-Commerce Industry Opposes New Indian Online Security Rules

IDG News Service — A decision by India's central bank to mandate another level of authentication for card use for online transactions will deter such transactions in the country, according to an association of India's e-commerce industry.

The Reserve Bank of India (RBI) told banks in February that it would require that online credit and debit card transactions have an additional level of authentication using information that is not visible on the card. The new rules come into force on Aug. 1.

To make a transaction, a user is currently required to enter his name, card number, card expiry date and card verification value (CVV), the three digits printed on the signature strip on the back of the card.

Banks are also required to have a system of online alerts to the card holder for online card transactions for a value of 5,000 Indian rupees (US$102) or above, the RBI said.

The addition of a new security password will add a new layer of complexity for people wanting to do business online, Mehul Gupta, associate vice president of IAMAI (Internet & Mobile Association of India) said on Wednesday.

Card holders have not been informed by their banks about the requirement for another level of authentication, which will lead to fewer transactions getting completed online once the new rules come into force, Gupta said.

Customers are already finding it difficult to complete transactions, because of the poor Internet connectivity in India, and the inadequate infrastructure of payment gateways, IAMAI said in a paper.

Additional authentication requirements will result in a high failure rate of transactions, and increase customer inconvenience, IAMAI added.

Online card fraud accounts for only 0.16 percent of the country's 92 billion rupees e-commerce industry in India, according to IAMAI estimates.

Most of that fraud is through cards that were not issued in India, and which are not covered under the new rules, Gupta said.

IAMAI has asked the RBI to delay implementation of its order, to give time to merchants and banks to improve their capabilities to handle the new authentication mechanism, and also to give customers sufficient time to get acquainted with it.

"Online card fraud, given its current miniscule scale, should ideally be seen as a business risk that merchants are free to take or not to take," IAMAI said. In the e-commerce environment in India, the risk arising from non-payment or fraud is borne by the merchant site and not the banks or the card companies, it added.