Who'll foot the bill? Banks or payment providers?

MUMBAI: The debit card security breach could open up a prolonged bickering among banks and with payment service providers as to who picks the tab for the likely losses arising out of the cybercrime, said bankers and consultants.

“The ultimate liability in such cases is something that is very complicated to be found out. It depends on the operating guidelines of the regulator and also on the understanding between the acquiring bank (which runs the ATM) and the issuing bank,“ said Loney Antony, managing director at Hitachi Payment Services.

The actual financial liability due to the breach is still not clear, though the NPCI puts it at just Rs 1.3 crore based on declarations by banks so far.

But it is not clear whether all banks have reported every suspected illegal transaction. Sources said the malware that led to the compromise was placed at Hitachi Payment and was activated through the ATMs of Yes Bank. Hitachi has denied this. Yes Bank has yet to respond publicly. "I am not an expert in ATMs ... but there is a systemic issue," said Yes Bank Chief Executive Rana Kapoor.

“The NPCI is a common denominator (for debit cards) especially as we migrate to RuPay cards. But NPCI's security features are among the best in the world. There will be some malware on and off, but there is heightened security. There are ATM models which are outsourced today and they require vigilance, quality and security controls. There needs to be vigilance in policing these risks."