Suggestions
Chandra Reddy
UI Developer - Senior software engineer - VIT 2017 - Front end - React - Redux - Javascript
Chandra Prakash Reddy is a skilled front end developer with expertise in React and JavaScript. He has a Bachelor's Degree in Computer Science from Vellore Institute of Technology. Chandra has previously worked at McAfee as a UI Developer and held positions as a Senior Software Engineer and Software Engineer at Ribbon Communications. He also has experience as a Software Intern at Vrinda Techapps. Check out his GitHub profile for more information.
Highlights
Yesterday evening, I got a message saying 10,000/- got debited from my Union Bank of India account out of nowhere. Then I got a mail saying my aadhar was used to succesfully authenticate a transaction using "finger print". I called my bank immediately and asked them about the transaction. They said money was transferred using Aadhar Card India. I was puzzled! How can money be drawn using Aadhar, it is not a debit/credit card after all.
Then, I called the cyber crime cell and they explained to me about the AEPS using Aadhar. Aadhar enabled Payment system lets users draw money using Aadhar number and finger print/iris/OTP. The criminals seem to be getting people's Aadhar and fingerprint details from land registration portals or other government websites and then using silica/film to capture the fingerprints to authenticate and draw money from our bank accounts.
This is enabled on your bank account if it is linked to Aadhar card. There is no need for OTP if the finger print is provided. The banks are refusing to unlink my aadhar card from my account. There is no way to disable this AEPS on our banks either. The only solution as of now seems to be to lock the biometrics on Unique Identification Authority of India (UIDAI) website.
The whole concept is mind boggling. We have to request for online banking explicitly in our bank, set username and password and OTP too. But this service - AEPS which doesn't even need OTP is enabled by default. A quick google search gave me dozens of news right from 2020 about people losing their money this way. And yet, nobody thought it was a good idea to make OTP mandatory for such transactions, especially since they know the fingerprint data is compromised?
How difficult is it to add simple checks such as the timings of these AEPS transactions? Clearly nobody is visiting a bank or any place at 10:30 or 11:00 in the night. A simple check to put transactions occurring outside of banking hours on hold would have saved thousands of victim's money.
The bigger question is about the leaked fingerprints. These can be potentially misused for any other fraudulent activities in addition to just fleecing money from people. Fake sims can be obtained using aadhar and fingerprint details, using which all the bank details and money can be captured. A person's idenity could be stolen and misused for terrorism or any other illegal activity.
Why wasn't data on government sites not safeguarded at the first instance of these frauds? Isn't 2 - 3 years enough to add security to important information on government websites such as land registration sites? I've registered a complaint on National Payments Corporation Of India (NPCI) website and visited a police station. They gave me some report and told me to submit it at the bank. The branch manager is telling me to not get my hopes high as there is very little chance of recovering money.
Reserve Bank of India (RBI)
#cybercrime #aadhar #aeps #fraud #fingerprint
