Internet bank account hacking has now expanded to RBI's much hyped One Time Password (OTP) security system. With few banks adopting OTP for online and credit card transactions, incidents of hacking have already been reported from Mumbai and Kolkata.

Cyber security analysts say there are multiple risks involved in the OTP system. While a mobile service provider can reissue a SIM card, if not used for 3 months, a hacker can also avail of a duplicate sim card by producing fake identification documents. In one such case of hacking in Kolkata, the fraudsters have approached the mobile service provider with a fake voter's ID of the bank customer and obtained a SIM card. The complainant filed under adjudication application.

"The OTP has exposed the vulnerability of mobile phones in internet banking. While there is talk about poor 'know your customer' (KYC) procedure in the banking sector, we should not forget that KYC is equally weak in the mobile phone sector. In the Kolkata case, by the time the fraudster managed to obtain a duplicate SIM card, the original customer's mobile phone was de-activated and even before he came to terms with the fault, the transaction had happened from his account," cyber security adviser N.A. Vijayashankar said.

In another case, the customer who had an online account went abroad and his attempts to de-register his account went in vain as the bank demanded his physical presence. Here again, his mobile number may get re-issued to a different customer by the mobile service provider. "Even if none of these compromises take place, hacking is still possible as fraudsters have been using malwares which these measures cannot thwart. Banks verify only login verification and not transaction verification. In the US, Federal Financial Institutions Examination Council (FFIEC) issued supplementary guidelines this June stating that OTP is vulnerable and explicitly states that transaction data verification should be done.

Banks in our country can go for the next-generation technology which can guarantee both login and transaction verification", said Mr Mohan Sundaram, who is CEO of firm Red Force Lab, which deals with cyber security solutions.

System Analyst IV
(HRISC) - Fusion Center / Houston Police Department
Criminal Intelligence/Homeland Security Division