ICICI Bank blocks 17,000 credit cards after data breach

ICICI Bank has blocked 17,000 credit cards after a technical glitch in its mobile banking application ‘iMobile’ led users to complain about being able to view other customers’ card details, including co-branded cards.

A number of users took to social media platform ‘X’ (formerly twitter) to post about being able to access card details of other customers including the complete card number, expiration date, and CVV. The glitch also allowed users to adjust the settings for these cards, such as enabling foreign transactions or changing of spend limits.

In response, ICICI Bank said that about 17,000 new credit cards which were issued in the past few days were “erroneously mapped in our digital channels to wrong users”. These cards constitute about 0.1 per cent of the bank’s credit card portfolio.

• Also read: Institutions vote for ICICI Securities-ICICI Bank merger, retail investors resist

“As an immediate measure, we have blocked these cards and are issuing new ones to the customers. No instance of misuse of a card from this set has been reported to us. However, we assure that the bank will appropriately compensate a customer in case of any financial loss,” the lender said in a statement.

Other experts on the ‘X’ platform advised users to flag any issues being seen in cards, and if so, to block their cards and get them replaced by the bank.

Customer complaints first surfaced on the financial forum, Technofino, where users highlighted instances of being able to access card details belonging to other customers while using the iMobile Pay app. Several users also raised concerns regarding the security protocols and checks and balances implemented to safeguard customer data.

“It’s a security glitch on ICICI Bank’s iMobile Pay app,” said Sumanta Mandal, founder of TechnoFino, a platform that reviews debit and credit cards.

The ICICI Bank incident came to light a day after the Reserve Bank of India on April 24 cracked down on Kotak Mahindra Bank, barring the lender from onboarding new customers through online and mobile banking channels and from issuing fresh credit cards.

The central bank said the sanctions were imposed d8ue to “significant concerns” arising out of IT examination of the bank for 2022 and 2023 and the “continued failure on part of the bank to address these concerns in a comprehensive and timely manner”.

COMMENT NOW