Shopping online? Credit card PIN a must

Come August 1, it will be compulsory to have a personal identification number (PIN)/password for all online credit and debit card transactions in the country.

This means that if you want to book airline/railway tickets or hotel reservations or buy anything online, a PIN will be a must.

A Reserve Bank of India directive has made it mandatory to have an authentication passcode Verified By Visa or Mastercard Secure Code (VBV/MSC) to make all online transactions safer.

This passcode is in addition to the other information that your credit/debit card already has, like your name, card number, expiry date and CVV (card verification value) number.

With the use of credit and debit cards rising in the country, RBI -- which has reviewing various options to enhance the security of online card transactions -- has come up with this decision in consultation with banks and card companies.

So, from August 1, says the Reserve Bank of India, it is a must for banks to have :

• A system of providing for additional authentication/validation based on information not visible on the cards for all on-line card not present transactions except IVR transactions (for which separate instructions will follow); and
• A system of 'Online Alerts' that can be sent to the cardholder for all 'card not present' transactions of a value of Rs 5,000 or more.

The Reserve Bank has asked banks to strictly adhere to the instructions, failing which banks will attract heavy penalties.

So how do you get the PIN? Read on. . .

How to get the PIN

Card users -- credit or debit -- are now required to register online with their card issuer (bank) by mentioning their personal and card details.

Once that has been done, the bank/card issuer will give you a PIN, or a password, that you will need to supply when you buy anything online. This will add an extra security layer at the checkout point before completion of the online transaction.

The PIN will be known only to the card holder. So, even if your card falls into the wrong hands or your card number is known to someone, they will not be able to buy anything online with it as they would not know the PIN/password.

The RBI directive has led to many people flooding the banks with requests for PIN, etc. Some banks are letting their customers create passwords on their Web sites and some others are sending new user IDs and passwords through post/courier.

Okay, so you have registered with VBV/MSC. Now what?

Now, every time you buy anything online, after entering your card details on the payment step, you will be redirected to your bank's Web site. You will need to enter your VBV/MSC password there after which you will be redirected back to the online shopping site for completion of the booking process.

What about American Express cards?

For Amex cards the 'extra level of authentication' will work slightly differently. On the payment step at the online shopping site, you will be asked to enter you billing address, which will be passed on to the bank. This will be checked against your billing address the bank has on its records.

If the addresses don't match your payment will be rejected. This technology is called AVS -- Address Verification System. You will need to check your credit card statement if you don't remember your exact billing address.

What if your bank does not support VBV/MSC?

The RBI notification concerns cards issued within India only. If your card is issued outside India, your online transactions will go through even without this extra authentication step (unless your Card Issuer requires SecureCode/VbV authentication).

Using a credit card? Now show photo identity!

Apart from this, RBI has also suggested that the next time you use your credit or debit card to buy something at your local mall/merchant store, you will need to show some photo identity card, like PAN card, passport or voter ID card. Especially, if you are making a high-value purchase. This is being done to check card frauds.

Credit/debit card frauds are constantly rising in the country with the usage of such cards growing. As most of these frauds are perpetrated by impersonating the actual cardholder, the central bank has suggested this move.

A security measure that has already been in use for quite a while now is the sending of emails or SMSs by the card issuer/bank to customers as soon as a high-value purchase is made on a card.

Merchants uneasy

Meanwhile, many merchants and online shopping site are trying to educate their customers to help them register at various bank sites for Verified by Visa and Mastercard Secure verification norms which banks in India are adopting in order to comply with the RBI guidelines.

Some merchants believe that this move could hit the online shopping business initially, but a better and more secure system in place will help curb online frauds. Although they believe that the RBI circular is correct in spirit, the manner in which the process is being implemented will cause disruption for customers and merchants.

Online travel company Cleartip.com, meanwhile, has said that this move 'puts Indian online companies at a disadvantage to international ones, because International companies do not have this extra hoop to jump through. Any (Indian) company that wants to serve an international audience is also at a disadvantage. This is because international customers will not be able to use sites from Indian merchants unless they have the additional password.'

Impact on WAP?

Another question raised by Cleartrip.com is how would the new system work on WAP, as the additional layer of security involves a redirection to the bank sites. Most mobile browsers might not support such redirection.

Does it really reduce the risk of fraud?

Cleartrip.com also mentions in a media statement that this norm might not necessarily be able to reduce the risk of fraud as it cannot stop people using Indian credit cards from purchasing at international Websites.

The statement said that the extra layer of verification is only for Indian merchants and stolen cards can be used to purchase internationally.