Indian Banks Warn Customers of Compromised Debit Cards

Nearly 3.2 million debit cards in India have been compromised by fraudsters, in what is one of the most widespread financial breaches worldwide. Customers complained of purchases and activities on their cards from locations they had never been, including places in China. A number of banks in India said the customers would either need to change their security codes or get new cards. It is estimated that 2.6 million of the debit cards are either Visa or MasterCard, and 600,000 are RuPay. The cards belonged to State Bank of India, which is believed to have been the most targeted bank, ICIC Bank, HDFC Bank, Axis Bank and Yes Bank. The cards are believed to have been hacked when customers used Hitachi Payment Services, which had been hit by malware that had yet to be detected. Hitachi supplies Automated Teller Machines (ARMs), Point of Sale (PoS) machines and other payment services across India.

A forensic audit of all payment systems in India is taking place, and banks have issued strict warnings to customers. “Besides advising those customers who we know have used a non-HDFC Bank ATM in the recent past to change (their) ATM PIN, we are advising our customers to use only HDFC Bank ATMs as we believe security controls at some of the other bank ATMs may not be at par with HDFC Bank ATMs,” HDFC Bank said in a statement. “We take this opportunity to reiterate that it’s always prudent to change ATM PINs from time to time. It prevents misuse.” The Chief Information Officer Mrutyunjay Mahapatra of SBI also disclosed to Economic Times of India “Based on the complaints we have received, we are suspecting a compromise on the non-SBI ATM network which could include various white-label ATM service providers,”
“Therefore, as a precautionary measure, we have blocked six lakh debit cards. We have assured our customers that there has not been any breach on the ATM network of SBI.” It is unclear if customers can resume using Hitachi machines at the moment and if any compensation will be made to those affected.