DIGITAL PAYMENTS SECURITY LAWS

Someone calls claiming to be from a bank. The voice is convincing, the caller knows the last 4 digits of the account and there is enough urgency in the conversation, that the threat appears to be real: verify immediately, or the account will be blocked. A few minutes later, the money is gone. But the transaction record has a much different story. The correct credentials were used. The OTP was entered. The payment was successfully verified. For the bank's system, there may be nothing unusual about this transaction. If the individual has lost the funds, it is obvious that it is a scam. The law is somewhere in between these two renditions of the same event. The question is one that is very hard to answer in the world of digital payment security today. India's payment system has turned into a remarkable machine at determining if the right PIN, password or OTP was provided. It is much less clear if the question is whether the person entering it really intended the transaction that ensued. This distinction matters because fraud itself has evolved. Being a criminal doesn't require necessarily hacking into a bank's servers or a password. In some cases, it is sufficient to make the victim feel the need to trust them, to make them feel like there's been a serious emergency, or to successfully mimic a familiar voice so that the victim will go through with the transaction on their own. Indian law doesn't attempt to solve this issue in a single act. The Payment and Settlement Systems Act 2007 has put payment systems under the regulatory control of the Reserve Bank of India . The Information Technology Act, 2000 provides for dealing with the problem of identity theft, cheating through personation and some failures in the context of electronic data. In addition to the remedies provided by consumer protection law, India's data protection law also imposes obligations on banks with regard to the security of personal data. In addition to these...