Data security breach: Card fraud sparks cyber cover rush

Insurance covers for computer frauds are witnessing an increased demand following a huge data compromise through automated teller machines (ATMs) in the country last week. Insurance companies say that banks are likely to go for higher cyber covers to prevent losses.

This follows reports of a suspected malware affecting as many 3.2 million debit cards, in what could be India's largest financial data breach. It was suspected that data was compromised on an ATM network of a small private bank, leading to a cumulative loss of Rs 1.23 crore among 641 customers. With this kind of data compromise and no-action being taken against the suspected bank or its ATMs by the regulator, banks will be forced to go for higher covers for computer fraud policies as these types of crimes are going to be on the rise, according to insurance experts.

India has about two lakh ATMs across the country. Tanuj Gulani, vice-president - specialty lines & reinsurance at Prudent Insurance Brokers, told DNA Money that the computer fraud policies covering both data and money losses are getting increased queries. "Companies that were contemplating this cover earlier are accelerating their purchases after such incidents, and those who did not think of it at all earlier are now enquiring about it. These risks affect not just the banks, financial institutions and mobile wallet companies but practically every industry. Many online businesses, retail chains, medical establishments and hotels have either bought covers or are in the process of buying."

Since the ATMs where the data compromise is believed to have happened continue to be fully-operational, banks across the spectrum are advising their customers to use only their own ATMs and not the teller machines of other banks. State Bank of India and HDFC Bank have already issued advisories to their clients on the need to use the in-house ATMs as a matter of precaution. From January this year, the RBI had asked banks to shift to the EMV chip technology, which is becoming the global standard for credit cards and debit cards. Named after its original developers (Europay, MasterCard and Visa), EMV technology features payment instruments (cards, mobile phones, etc.) with embedded microprocessor chips that store and protect cardholder data. The cost of replacing the magnetic cards with chip-based is pegged at Rs 40 a card.

Sanjay Kedia, country head and CEO, Marsh India Insurance Brokers, said, "Card replacement, notifying affected customers and forensics to do root cause analysis and size/scope of the problem are covered under 'Cyber Insurance' that only a few large banks have. But others are actively exploring. The recent RBI circular on cyber security makes it mandatory for banks to make immediate disclosure of such cases and have empaneled forensics and crisis consultants."

National Payment Corporation of India (NPCI), the umbrella organisation for all retail payments in the country, bought a computer fraud policy six months back, according to a senior official of an insurance company.
Meanwhile, NPCI said in a statement, "If customers have not received any communication from their bank then they can be sure that the debit card is not at risk. NPCI would like to state that there is no need to panic as the problem has been identified and actions are already taken."