Recently, the Reserve Bank of India relaxed the two-factor authentication requirement for card transactions up to ₹2,000.
Does that mean you can now finish your online shopping more quickly?
No, the recent relaxation does not apply to such ‘card not present’ transactions. It applies only to transactions where you physically use plastic and within that, to ‘contactless’ cards. To understand what has really changed, some background will help.
In case of CNP transactions, the three-digit ‘cvv’ number at the back of the card served the purpose of a second-level authentication, after you entered details such as name, card number and expiry date.
But the RBI felt these checks were not enough as merchants couldn’t tell an authentic signature from a forged one in case of CP transactions.
In CNP transactions, checks such as the cvv number that are already available on the card, did not really make for a second level of authentication in the true sense.
So, it brought in additional checks. For CP transactions, you had to type in a PIN number as the second level authentication. For CNP transactions, you could either key in a pre-set password or generate a one-time password which was sent across to your mobile phone.
Hence, all card transactions, until now, required you to enter a PIN to complete a transaction. When you make payment for Uber-like cab services, you have to pre-load your wallet, by signing into Paytm — a payment services entity that Uber is tied up with. The fare is automatically deducted from your mobile wallet.
What’s changed? The RBI’s recent relaxation does away with entering the PIN for transactions less than ₹2,000 where the card is physically present. Moreover, in such CP transactions, cards should be chip cards adhering to EMV (Europay, MasterCard and Visa) standards using Near Field Communication (NFC) or contactless technology. Any transaction up to ₹2,000 made through these NFC-enabled cards, now does not require second factor authentication. NFC cards need not be inserted into a machine; you just need to tap them to make a payment. Banks are allowed to set a lower limit (below ₹2,000) and also fix the number of such small ticket transactions in a day, week or month, where they would waive the second level check.
Bottomline So, are your small ticket purchases — in super markets, quick service restaurants and cab fares — just a tap away?
Well, not quite. For one, the number of banks that issue NFC cards are few, and it may not make sense to switch your bank just to procure such a card.
SBI, ICICI Bank and Axis Bank (currently rolling out) have launched such cards.
Two, apart from your card being NFC-compliant, the terminal at the merchant’s end also needs to be NFC-enabled.
Banks and POS providers will need to quickly roll out NFC-enabled terminals across the country to enable the use of contactless cards.
Axis Bank recently announced plans to enable all its POS terminals with NFC-based card acceptance, with an immediate rollout at 20,000 terminals, scaling it up to 50,000 terminals by end of the year.
Yet, if your bank is issuing these cards, you can opt to have one anyway. While it may take a while for the contactless technology to become universal, you can still use the NFC card by swiping it and entering the PIN to make the payment.
These contactless cards are also EMV-compliant like the ones you have and you can still use them across existing infrastructure. If you are not comfortable skipping the two-factor authentication, you can still choose to enter your PIN even later on.