Indian banks replace millions of debit cards after possible breach

Indian banks have asked customers to change the PINs, and in some cases blocked access, to 3.2 million debit cards after concerns about a security breach.

The issue surfaced in September when some banks complained that their customers’ cards were used fraudulently mainly in China and the U.S. while the account holders were in India, the National Payments Corporation of India said late Thursday.

India’s top government-controlled bank, the State Bank of India, said earlier this week that after card network companies like Visa and MasterCard had informed various banks of a potential risk to some cards because of a data breach, it had taken the precautionary measure of blocking the cards identified by the networks.

The bank said it was in the process of issuing new cards and assured its customers that its own systems were not compromised.

A spokeswoman for India’s central bank, the Reserve Bank of India, did not deny the issue but said the RBI has not yet decided to discuss it publicly.

Initial reports suggested that hackers had accessed the data through malware on automated teller machines. “Apprehending that this could be a case of card data compromise, all the ATMs / PoS terminals in India and three card networks – RuPay, Visa and MasterCard worked in a collaborative manner in the month of September 2016,” NPCI said in a statement.

It was subsequently established that there was a possible compromise at one bank’s payment switch that ran the back end of ATMs. The name of the bank or the payment switch provider have not been disclosed.

Some 640 customers of 19 banks were found to have been directly affected, and about 13 million rupees (US$194,800) were defrauded. Banks have advised their customers to change their debit card PIN.

In cases where customers could not be contacted, the cards have been blocked and fresh cards are being issued by member banks. NPCI said it would issue further recommendations to banks soon as investigations continue.

“Necessary corrective actions already have been taken and hence there is no reason for bank customers to panic,” said A.P. Hota, CEO of NPCI. The advisory issued by NPCI to banks for “re-cardification is more as a preventive exercise,” he added.