IFSI Project Report

on
Technology in Banking Services

Prepared by:
Group # 05 – Section B

Group Members:
Avishek Hota (PGDMB15-029)
Puja Agarwala (PGDMB15-105)
Pulkit Sharma (PGDMB15-106)
Srikumaran M A (PGDMB15-141)
Swapnil Agrawal (PGDMB15-152)
Sravan Kumar M (PGDMB15-184)
 DECLARATION

We hereby declare that this work titled ―Technology in Banking Services‖ is a

record of a project done by us under the guidance of Prof. Ramesh
Subramaniam, Institute for Financial Management and Research and this
project work has not formed the basis for the award of any other degree.

NAME ROLL NO SIGNATURE

Avishek Hota 029

Puja Agarwala 105

Pulkit Sharma 106

Srikumaran M A 141

Swapnil Agrawal 152

Sravan Kumar M 184

Place: Sri City

Date: 31.12.2014

Verified by: Prof. Ramesh Subramaniam

Page 2
 INDEX
1. Introduction........................................................................................................4
2. Why technology was needed? ...........................................................................6
3. Technologies in Banking Services ....................................................................7
4. Modes aiding implementation of Technology in Banking ...........................24
5. Security in Banking .........................................................................................27
6. Impact of Technology ......................................................................................29
7. Negative Impact of Technology in Banking ..................................................35
8. Security Issues in Online Banking .................................................................36
9. Recent Trends in Technology for Banking services .....................................39
10. Recommendations for strengthening Cyber Security ...............................42
11. Recommendations for Technology adoption in Banking services ...........46
12. Conclusion .....................................................................................................51

Page 3
1. Introduction

1.1. History of Indian Banking

The first banks were The General Bank of India which started in 1786, and the Bank of
Hindustan, both of which are now defunct. The oldest bank in existence in India is the State
Bank of India, which originated in the Bank of Calcutta in June 1806, which almost immediately
became the Bank of Bengal. This was one of the three presidency banks, the other two being the
Bank of Bombay and the Bank of Madras, all three of which were established under charters
from the British East India Company. For many years the Presidency banks acted as quasi-
central banks, as did their successors. The three banks merged in 1921 to form the Imperial Bank
of India, which, upon India's independence, became the State Bank of India. Indian merchants in
Calcutta established the Union Bank in 1839, but it failed in 1848 as a consequence of the
economic crisis of 1848-49. The Allahabad Bank, established in 1865 and still functioning today,
is the oldest Joint Stock bank in India.(Joint Stock Bank: A company that issues stock and
requires shareholders to be held liable for the company's debt) It was not the first though. That
honor belongs to the Bank of Upper India, which was established in 1863, and which survived
until 1913, when it failed, with some of its assets and liabilities being transferred to the Alliance
Bank of Shimla.

When the American Civil War stopped the supply of cotton to Lancashire from the Confederate
States, promoters opened banks to finance trading in Indian cotton. With large exposure to
speculative ventures, most of the banks opened in India during that period failed. The depositors
lost money and lost interest in keeping deposits with banks. Subsequently, banking in India
remained the exclusive domain of Europeans for next several decades until the beginning of the
20th century. Foreign banks too started to arrive, particularly in Calcutta, in the 1860s. The
Comptoire d'Escompte de Paris opened a branch in Calcutta in 1860, and another in Bombay in
1862; branches in Madras and Puducherry, then a French colony, followed. HSBC established
itself in Bengal in 1869. Calcutta was the most active trading port in India, mainly due to the
trade of the British Empire, and so became a banking center. The first entirely Indian joint stock
bank was the Oudh Commercial Bank, established in 1881 in Faizabad. It failed in 1958. The
next was the Punjab National Bank, established in Lahore in 1895, which has survived to the
present and is now one of the largest banks in India. Around the turn of the 20th Century, the
Indian economy was passing through a relative period of stability. Around five decades had
elapsed since the Indian Mutiny, and the social, industrial and other infrastructure had improved.
Indians had established small banks, most of which served particular ethnic and religious
communities.

The presidency banks dominated banking in India but there were also some exchange banks and
a number of Indian joint stock banks. All these banks operated in different segments of the
economy. The exchange banks, mostly owned by Europeans, concentrated on financing foreign

Page 4
trade. Indian joint stock banks were generally undercapitalized and lacked the experience and
maturity to compete with the presidency and exchange banks. This segmentation let Lord Curzon
to observe, "In respect of banking it seems we are behind the times. We are like some old
fashioned sailing ship, divided by solid wooden bulkheads into separate and cumbersome
compartments." The period between 1906 and 1911, saw the establishment of banks inspired by
the Swadeshi movement. The Swadeshi movement inspired local businessmen and political
figures to found banks of and for the Indian community. A number of banks established then
have survived to the present such as Bank of India, Corporation Bank, Indian Bank, Bank of
Baroda, Canara Bank and Central Bank of India.

India's independence marked the end of a regime of the Laissez-faire for the Indian banking. The
Government of India initiated measures to play an active role in the economic life of the nation,
and the Industrial Policy Resolution adopted by the government in 1948 envisaged a mixed
economy. This resulted into greater involvement of the state in different segments of the
economy including banking and finance. The major steps to regulate banking included

The Reserve Bank of India, India's central banking authority, was nationalized on January 1,
1949 under the terms of the Reserve Bank of India (Transfer to Public Ownership) Act, 1948
(RBI, 2005b). In 1949, the Banking Regulation Act was enacted which empowered the Reserve
Bank of India (RBI) "to regulate, control, and inspect the banks in India.‖

The Banking Regulation Act also provided that no new bank or branch of an existing bank could
be opened without a license from the RBI, and no two banks could have common directors. By
the 1960s, the Indian banking industry had become an important tool to facilitate the
development of the Indian economy.

At the same time, it had emerged as a large employer, and a debate had ensued about the
possibility to nationalize the banking industry. Indira Gandhi, the-then Prime Minister of India
expressed the intention of the GOI in the annual conference of the All India Congress Meeting in
a paper entitled "Stray thoughts on Bank Nationalization." The paper was received with positive
enthusiasm.

The GOI issued an ordinance and nationalised the 14 largest commercial banks with effect from
the midnight of July 19, 1969. Jayaprakash Narayan, a national leader of India, described the
step as a "masterstroke of political sagacity." Within two weeks of the issue of the ordinance, the
Parliament passed the Banking Companies (Acquisition and Transfer of Undertaking) Bill, and it
received the presidential approval on 9 August 1969.

A second dose of nationalization of 6 more commercial banks followed in 1980. The stated
reason for the nationalization was to give the government more control of credit delivery. With
the second dose of nationalization, the GOI controlled around 91% of the banking business of
India. Later on, in the year 1993, the government merged New Bank of India with Punjab
National Bank. It was the only merger between nationalized banks and resulted in the reduction

Page 5
of the number of nationalised banks from 20 to 19. After this, until the 1990s, the nationalised
banks grew at a pace of around 4%, closer to the average growth rate of the Indian economy.

In the early 1990s, the then Narsimha Rao government embarked on a policy of liberalization,
licensing a small number of private banks. These came to be known as New Generation tech-
savvy banks, and included Global Trust Bank (the first of such new generation banks to be set
up), which later amalgamated with Oriental Bank of Commerce, Axis Bank(earlier as UTI
Bank), ICICI Bank and HDFC Bank.

This move, along with the rapid growth in the economy of India, revitalized the banking sector in
India, which has seen rapid growth with strong contribution from all the three sectors of banks,
namely, government banks, private banks and foreign banks. The next stage for the Indian
banking has been set up with the proposed relaxation in the norms for Foreign Direct Investment,
where all Foreign Investors in banks may be given voting rights which could exceed the present
cap of 10%, at present it has gone up to 74% with some restrictions.

2. Why technology was needed?

With the globalization trends world over it is difficult for any nation big or small, developed or
developing, to remain isolated from what is happening around. For a country like India, which is
one of the most promising emerging markets, such isolation is nearly impossible. More
particularly in the area of Information technology, where India has definitely an edge over its
competitors, remaining away or uniformity of the world trends is untenable. Financial sector in
general and banking industry in particular is the largest spender and beneficiary from
information technology. This endeavours to relate the international trends in it with the Indian
banking industry.

The last lot includes possibly all foreign banks and newly established Private sector banks, which
have fully computerized all the operations. With these variations in the level of information
technology in Indian banks, it is useful to take account of the trends in Information technology
internationally as also to see the comparative position with Indian banks.

2.1 Disadvantages of Traditional Banking.

2.1.1 Limited Accessibility

Accessibility at traditional banks is limited, as you can only conduct business at their brick-and-
mortar locations. If you‘re traveling or unable to make it into the location during standard hours
of operation, you won‘t be able to do business.

Page 6
2.1.2 Less Efficient

Getting in the car, driving to a bank and waiting in line to be served takes up your valuable time.
It is more efficient to do your banking online, where you can open new accounts, set up auto bill
pay, check account balances and transfer funds all from your own computer.

2.1.3 Lower Interest Rates on Savings

Online banks are typically able to offer much lower interest rates than traditional banks, because
they have much lower overhead costs. An October 2013 study by MoneyRates.com, revealed
that the average interest rate for a savings account at an online business was 0.569 percent, while
it was just 0.123 percent at a traditional bank.

2.1.4 Greater Minimum Account Balance

Traditional banks typically require you to maintain a much greater monthly account balance than
online banks do. According to a May 2013 Business Insider article, traditional banks require an
average of $4,700 to be kept in a savings account, without charging you a monthly maintenance
fee, while online banks average just $350.

A development in the field of information technology strongly supports the growth and
inclusiveness of the banking sector by facilitating inclusive economic growth. IT improves the
front end operations with back end operations and helps in bringing down the transaction costs
for the customers.

3. Technologies in Banking Services

3.1 Customer Relationship Management in Banking

Good Customer Service is the best brand ambassador for any bank. The entire business process
consists of highly integrated efforts to discover, create, arouse and satisfy customer‘s needs. The
modern business has realized it and is making all out efforts to become ‗customer-centric‘ across
the globe. Hence, CRM is not a once-for-all affair but a continuous process. It is the way of
carrying out business covering all the aspects of the modern business. It is an integral approach
of dealing with customers by deploying the advanced information technology.

CRM is the Information Technology face of the business process that aims to establish enduring
and mutually-beneficial relationships with customers in order to drive customer retention, value
and profitability. It is meant for a common and equal good of the two stakeholders-businesses
and their customers. It calls for capturing pertinent data about the prospective and current
customers in respect of their buying pattern, shopping behavior and usage habits. It represents
the current philosophy that the businesses should be customer oriented.

Page 7
CRM is a tool for delivering a variety of marketing dreams such as:

 To target and serve customers on an individual basis. It permits one to one Marketing as
opposed to mass marketing.
 It helps in establishing durable relationship with customers.
 It is to dis-intermediaries channels of the wasteful barriers and distortions.
 It helps in reducing marketing cost progressively.

The important factors that establish the need for CRM in the Banking Industry are
detailed below:
 Intense Competition There is intense competition among the Private Sector Banks, Public
Sector Banks and Foreign Banks and they are all taking steps to attract and retain the
customers.
 New technologies, research facilities, globalization of services, the flood of new products and
the concept of all the facilities under one roof to provide better customer service leading to
customer delight.
 Well Informed Customers The Customers in Banking Industry today are well informed. With
the introduction of new technology, the world has become like a small village. Thus, if a
Bank wants to have more customers, it should develop a good relationship with its present
customers and try to maintain the same in the future also.
 Decline in Brand Loyalty
 In the present scenario, brand loyalty is on decline. The customers are switching over
frequently to avail the better facilities from other banks. Newer and superior products and
services are being introduced continuously in the market. Thus, the banks have to upgrade
their products, improve customer service and create bonds of trusts through proper care of
customer needs and regular communications. With the help of CRM, strong customer loyalty
and a good image for the organization can be developed.
 Improved Customer Retention
 In the intensely competitive banking industry, retention of existing customers is vital, which
can be achieved through the process of CRM.

3.1.1 Introduction of Innovative Services through CRM

 Banks have made several innovations for sustenance by using the CRM System such as:
 The introduction of ATMs.
 Biometric ATMs.
 Single Window Service.
 Teller System.
 Internet Banking
 Introduction of Plastic Money: Credit Card, Debit Card, Smart Card.

Page 8
 Mobile and E-Mail Alerts
 Electronic Cash
 Introduction of two in one Accounts.
 Introduction of new loan schemes as per the customer‘s needs viz. Education Loans,
Marriage Loans, Housing Loans, Personal Loans, Vehicle Loans, Furniture Loans,
Renovation Loans and Tourism Loans.

3.1.2 Benefits of CRM

Benefits of CRM can be categorized into three groups namely: Benefits for customers, benefits
for employees and benefits for banks.
(i) Benefits for Customers.

 There is a more coordinated and professional approach to customer contact.

 With up-to-date customer information, Banks can offer more personalized services.
 Customers feel empowered if they have greater access to products and services. For example
24 Hours banking.
 Targeted product and service offerings can be timed to coincide with customer events and
requirements e.g., Education Loans and Tourism Loans.

(ii) Benefits for Employees.

 Employees are empowered with the information to deliver high quality service and meet

 Employees have more time to serve customers.

customer expectations.

 Employees have higher satisfaction ratings.

(iii) Benefits for Banks.

 Managers are empowered with information that can help them manage customer
relationships and make better decisions.
 Optimum use of resources.
 Customer satisfaction and increased loyalty.
 Improved customer acquisition and cross-selling.
 It helps in capitalizing on short windows of opportunities in the market.

Page 9
3.1.3 Conclusion
While analyzing the CRM Implementation in both the sectors, it was found that the Private
Sector Banks have been able to implement the CRM practices more effectively when compared
to their Public Sector counterparts. This indicates that strategically speaking, the Private Sector
Banks have been more innovative in understanding their customers and in building good
relations with them.

This fact has further been corroborated by the findings of the service quality level being provided
by these banks. These suggest that in case of the Private Sector Banks, all the five dimensions of
service quality have scored higher values when compared to the Public Sector Banks. It also
points towards the same fact that these banks have been able to enhance the service quality levels
for their customers making them more customer oriented.

Further, it has been observed by analyzing the service quality dimensions that responsiveness
and empathy of both the Public as well as the Private Sector Banks, scored the least. However, a
micro analysis reveals that the Public Sector Banks have highest scores in terms of reliability and
assurance whereas the Private Sector Banks have fared better in terms of tangibility, reliability
and assurance. This indicates that the banks are in a dire need to make proper strategies to
improve their working. This will make the banks more efficient in serving the customers and in
maintaining the long term relations with them.

The analysis of the results received on customer retention suggests that the banks (whether
Public or Private) are equally affected by the kind of CRM initiatives they undertake to retain the
customers. The banks are now under tremendous pressure to retain the older customers because
of the competition in the Banking Sector. This would not only ensure better customer relations
but also loyalty among them, which is very critical and important in today‘s competitive world.

Banks have started acknowledging the importance of the customers in developing their business.
They have recognized that it is essential to protect and grow its customer base and ultimately its
profitability. The banks can do this by building a strong relationship with the customers. To meet
the customer needs and to beat the competition, they must deliver superior quality service. The
CRM approach adopted by banks focuses on maximizing the value for the customer and the
bank.

Page 10
3.2 Online Banking

Online banking is an electronic payment system that enables customers of a financial

institution to conduct financial transactions on a website operated by the institution, such as a
retail bank, virtual bank, credit union or building society. Online banking is also referred
as Internet banking, e-banking, virtual banking and by other terms.
To access a financial institution's online banking facility, a customer with Internet access would
need to register with the institution for the service, and set up some password (under various
names) for customer verification. The password for online banking is normally not the same as
for telephone banking. Financial institutions now routinely allocate customers numbers (also
under various names), whether or not customers have indicated an intention to access their online
banking facility. Customers' numbers are normally not the same as account numbers, because a
number of customer accounts can be linked to the one customer number. The customer can link
to the customer number any account which the customer controls, which may be cheque,
savings, loan, credit card and other accounts. Customer numbers will also not be the same as any
debit or credit card issued by the financial institution to the customer.
To access online banking, a customer would go to the financial institution's secured website, and
enter the online banking facility using the customer number and password previously setup.
Some financial institutions have set up additional security steps for access to online banking, but
there is no consistency to the approach adopted.
Online banking facilities offered by various financial institutions have many features and
capabilities in common, but also have some that are application specific.
Core Banking Solution

CBS is a centralized platform, which creates environment where the entire bank‘s operations can
be controlled, and run from a centralized hub. This creates a centralized customer database,
which makes anytime, anywhere, anyway banking possible.

Immediate advantages of CBS are:

 Faster and efficient customer service.

 Offering multiple delivery channels, like ATMs, Cards, mobile/Telephone Banking, internet
Banking, Call centers, etc.
 Reducing the operational costs, through manpower saving and space saving.
 Centralizing the back end processes and reporting.

Page 11
The common features fall broadly into several categories:

 A bank customer can perform non-transactional tasks through online banking, including -

 Viewing account balances

 Viewing recent transactions
 Downloading bank statements, for example in PDF format
 Viewing images of paid cheques
 Ordering cheque books
 Download periodic account statements
 Downloading applications for M-banking, E-banking etc.

 Bank customers can transact banking tasks through online banking, including,

 Funds transfers between the customer's linked accounts

 Paying third parties, including bill payments and third party fund transfers
 Investment purchase or sale
 Loan applications and transactions, such as repayments of enrollments
 Credit card applications
 Register utility billers and make bill payments

 Financial institution administration

 Management of multiple users having varying levels of authority
 Transaction approval process
 the process of banking has become much faster
Some financial institutions offer unique Internet banking services, for example:

 Personal financial management support, such as importing data into personal accounting
software. Some online banking platforms support account aggregation to allow the customers
to monitor all of their accounts in one place whether they are with their main bank or with
other institutions.

Page 12
3.3 Mobile banking
RBI has permitted 89 banks to provide mobile banking service in India as on October 17,2014.
Mobile phones as a delivery channel for extending banking services have off-late been attaining
greater significance. The rapid growth in users and wider coverage of mobile phone networks
have made this channel an important platform for extending banking services to customers. With
the rapid growth in the number of mobile phone subscribers in India (about 261 million as at
the end of March 2008 and growing at about 8 million a month), banks have been exploring the
feasibility of using mobile phones as an alternative channel of delivery of banking
services. Some banks have started offering information based services like balance enquiry, stop
payment instruction of cheques, transactions enquiry, location of the nearest ATM/branch etc.
Acceptance of transfer of funds instruction for credit to beneficiaries of same/or another bank in
favor of pre-registered beneficiaries have also commenced in a few banks. In order to ensure a
level playing field and considering that the technology is relatively new, Reserve Bank has
brought out a set of operating guidelines for adoption by banks.

For the purpose of these Guidelines, ―mobile banking transactions‖ is undertaking banking
transactions using mobile phones by bank customers that involve credit/debit to their accounts. It
also covers accessing the bank accounts by customers for non-monetary transactions like balance
enquiry etc.

3.3.1. SMS banking

SMS banking is a technology-enabled service offered by banks to its customers. They permit the
customers to operate banking services over mobile phones using SMS messages. SMS banking is
more advantageous than Internet banking because people carry mobile phones everywhere. SMS
banking reduces the distances between banks and the customers.

3.3.2. Registration of customers for mobile service

 Banks shall put in place a system of document based registration with mandatory physical
presence of their customers, before commencing mobile banking service.
 On registration of the customer, the full details of the Terms and Conditions of the service
offered shall be communicated to the customer.

3.3.3. Technology and Security Standards

Information Security is most critical to the business of mobile banking services and its
underlying operations. Therefore, technology used for mobile banking must be secure and should
ensure confidentiality, integrity, authenticity and non-repudiability (refers to a state of affairs
where the purported maker of a statement will not be able to successfully challenge the validity
of the statement or contract). An illustrative, but not exhaustive framework is given below.

Page 13
The security controls/guidelines mentioned are only indicative. However, it must be recognized,
the technology deployed is fundamental to safety and soundness of any payment system.
Therefore, banks are required to follow the Security Standards appropriate to the complexity of
services offered, subject to following the minimum standards set out in this document. The
guidelines should be applied in a way that is appropriate to the risk associated with services
provided by the bank and the system which supports these services.

Banks are required to put in place appropriate risk mitigation measures like transaction limit (per
transaction, daily, weekly, monthly), transaction velocity limit, fraud checks, AML checks etc.
depending on the bank‘s own risk perception, unless otherwise mandated by the Reserve Bank.

3.3.4. Authentication

Banks providing mobile banking services shall comply with the following security principles and
practices for the authentication of mobile banking transactions:

i. All mobile banking shall be permitted only by validation through a two factor
authentication.
ii. One of the factors of authentication shall be mPIN or any higher standard.
iii. Where mPIN is used, end to end encryption of the mPIN shall be ensured, i.e mPIN shall
not be in clear text anywhere in the network.
iv. The mPIN shall be stored in a secure environment.

In the application based service, all messages originating from your mobile phone are encrypted
and travel to our Mobile Banking Server in secured mode. The encryption methodology used is
128 bit AES technology. In the WAP based service, the site is Verisign certified.

Four Proper level of encryption and security shall be implemented at all stages of the transaction
processing. The endeavor shall be to ensure end-to-end encryption of the mobile banking
transaction. Adequate safe guards would also be put in place to guard against the use of mobile
banking in money laundering, frauds etc. The following guidelines with respect to network and
system security shall be adhered to:

a) Implement application level encryption over network and transport layer encryption wherever
possible.
b) Establish proper firewalls, intruder detection systems (IDS), data file and system integrity
checking, surveillance and incident response procedures and containment procedures.
c) Conduct periodic risk management analysis, security vulnerability assessment of the
application and network etc at least once in a year.
d) Maintain proper and full documentation of security practices, guidelines, methods and
procedures used in mobile banking and payment systems and keep them up to date based
on the periodic risk management, analysis and vulnerability assessment carried out.
e) Implement appropriate physical security measures to protect the system gateways,
network equipments, servers, host computers, and other hardware/software used from
unauthorized access and tampering. The Data Centre of the Bank and Service Providers
should have proper wired and wireless data network protection mechanisms.

Page 14
The dependence of banks on mobile banking service providers may place knowledge of bank
systems and customers in a public domain. Mobile banking system may also make the banks
dependent on small firms ( i.e mobile banking service providers) with high employee turnover. It
is therefore imperative that sensitive customer data, and security and integrity of transactions are
protected. It is necessary that the mobile banking servers at the bank‘s end or at the mobile
banking service provider‘s end, if any, should be certified by an, accredited external agency. In
addition, banks should conduct regular information security audits on the mobile banking
systems to ensure complete security.

For channels which do not contain the phone number as identity, a separate login ID and
password shall be provided to ensure proper authentication. Internet Banking login IDs and
Passwords shall not be allowed to be used for mobile banking.

3.3.5. Future biometric-based security

New smartphones are already being released to leverage this sort of capability. The newest
version of the Android mobile operating system, Ice Cream Sandwich, uses facial recognition
technology to unlock a user‘s phone. And Apple‘s introduction of Siri on the iPhone is setting
the stage for voice recognition capabilities to come.

One needs to look at this mobile payments displacing traditional credit card (plastic). So you first
have to match the convenience of the current swipe at the merchant POC. Then you have to deal
with the security issue. Which when you think about the state of credit card usage (without
EMV) and the amount of fraud that exists, if you could secure your confidential data in the cloud
or a secure location but not on the mobile device, you could have a situation where the mobile
payment is more secure than plastic

3.3.6. Inter-operability

Banks offering mobile banking service must ensure that customers having mobile phones of any
network operator is in a position to avail of the service. Restriction, if any, to the customers of
particular mobile operator(s) is permissible only during the initial stages of offering the service,
up to a maximum period of six months subject to review.

The long term goal of mobile banking framework in India would be to enable funds transfer
from account in one bank to any other account in the same or any other bank on a real time basis
irrespective of the mobile network a customer has subscribed to. This would require inter-
operability between mobile banking service providers and banks and development of a host of
message formats. To ensure inter-operability between banks, and between their mobile banking
service providers banks shall adopt the message formats like ISO 8583, with suitable
modification to address specific needs.

3.3.7. Approval of Reserve Bank of India

Banks wishing to provide mobile banking services shall seek prior one time approval of the
Reserve Bank of India, by furnishing full details of the proposal.

Page 15
The Mobile Banking Services works over two modes: (i) a Java based application which is
downloaded onto your mobile handset. The services are Menu driven and the requests are sent to
the Bank using SMS/ GPRS facility (ii) over WAP which can be used by customers having any
mobile (java/ non java) with GPRS connection. This is also menu driven. The service for
nonjava, non GPRS mobile have been made available over USSD. (Please refer to FAQ for
USSD) and through SMS Banking

You can do three types of transactions:

a. Transfer to Self accounts.

b. Transfer to other accounts in intra bank branches.
c. Transfer to accounts in other banks.
d. Fund Transfer to accounts in Intra bank and other banks through IMPS.

3.3.8. Advantages

 It utilizes the mobile connectivity of telecom operators and therefore does not require an
internet connection.
 With mobile banking, users of mobile phones can perform several financial functions
conveniently and securely from their mobile.
 You can check your account balance, review recent transaction, transfer funds, pay bills,
locate ATMs, deposit cheques, manage investments, etc.
 Mobile banking is available round the clock 24/7/365, it is easy and convenient and an ideal
choice for accessing financial services for most mobile phone owners in the rural areas.
 Mobile banking is said to be even more secure than online/internet banking.
 Your mobile banking ―identity‖ is tied to a specific phone: Done correctly, your mobile
―identity‖ can be linked to a specific device, making traditional ―man in the middle‖ security
compromises much less relevant.
 Consumers can mitigate fraud in real time: SMS (short message service) and push messages
for smartphones allow consumers to help banks monitor for fraudulent transactions as they
happen.

3.3.9. Disadvantages

 Mobile banking users are at risk of receiving fake SMS messages and scams.
 The loss of a person‘s mobile device often means that criminals can gain access to your
mobile banking PIN and other sensitive information.
 Modern mobile devices like Smartphone and tablets are better suited for mobile banking
than old models of mobile phones and devices.
 Regular users of mobile banking over time can accumulate significant charges from their
banks.

Page 16
3.4 Indian Bills Payments System - GIRO Model For Payments

In the Second Quarter Review of Monetary Policy 2012-13, Governor, Reserve Bank of India
announced the setting up of a Committee to finalize the modalities of implementing an electronic
GIRO payment system-both electronic and cheque based in India. Earlier, the RBI, in its
Payment Systems Vision in India 2012-15, had identified the need for developing an electronic
bill payment system based on a GIRO model for payments towards insurance premia, utility
payments, taxes, school fees, etc.
Accordingly, a Committee under the chairmanship of Shri G. Padmanabhan, Executive Director,
RBI was set up to study the feasibility of implementation of an electronic GIRO payment system
in the country.

3.4.1 Scope of GIRO

A GIRO is a payment instruction from one bank account to another bank account which is
initiated by the payer. As the payment systems evolved, GIRO came to include acceptance of
third party payments at Banks, debit authorisation of recurring payments and also clearing and
settlement payment networks in different countries. The Committee observed that in the Indian
context, where cash continues to the predominant mode of payment, GIRO could include any
third party payment made through any payment mode viz. cash, cheque, credit/debit cards,
prepaid payment instruments, etc. resulting in the transfer of funds to the bank account of a
beneficiary.

A wide range of payment instruments viz. cheque, debit/credit cards, prepaid instruments etc.
and retail payment channels viz. NEFT, NECS, ECS(Debit), IMPS etc. are available in the
country. Even non-banks have been permitted to issue prepaid payment instruments and effect
P2P domestic money transfers in a limited way.

While the existing systems are safe and robust, the existing systems did not fully address the
needs of a consumer to pay the utility bills, school/university fee etc. for the following reasons -

 Lack of interoperability in the bill payment processes requiring the consumers to make
payments at the respective Billers Own Collection Point or his agent.
 Consumer preference for payment at BOCPs, which provides him instant receipt confirming
the payment of the bill and lack of trust in the agents.
 A vast majority of the consumers have no access to other modes of electronic payments or
are wary of using them.

Bill payment is a major component of the retail payment transactions. It is estimated that over
30,800 million bills are generated each year in the top 20 cities in the country. The Cash and

Page 17
Cheque collections constitute over 90 percent and electronic payments through ECS etc.
continue to be low.

Intermediaries/Aggregators play an important role in the bill payment system in India. They
provide payment collection services to the billers through various agent outlets and also offer
reconciliation services to the billers. However, the intermediaries/aggregators operate on the
basis of bilateral agreements with the billers. There is a lack of coordinated industry initiative to
develop a common interoperable bill payment system. There is, therefore, a need for a GIRO
payment model for India which will be interoperable, enable third party payments and also
provide for acceptance of payment in cash and cheque as well.

3.4.2 A Brief discussion on various Payment Channels/Modes

a) E cheques

Nowadays we are hearing about e-governance, e-mail, e-commerce, e-tail etc. In the same
manner, a new technology is being developed in US for introduction of e-cheque, which will
eventually replace the conventional paper cheque. India, as harbinger to the introduction of e-
cheque, the Negotiable Instruments Act has already been amended to include; Truncated cheque
and E-cheque instruments.

b) Real Time Gross Settlement (RTGS)

Real Time Gross Settlement system, introduced in India since March 2004, is a Interlink
Research Analysis system through which electronics instructions can be given by banks to
transfer funds from their account to the account of another bank. The (RTGS) Real Time Gross
Settlement system is maintained and operated by the RBI and provides a means of efficient and
faster funds transfer among banks facilitating their financial operations. As the name suggests,
funds transfer between banks takes place on a ‗Real Time‘ basis. Therefore, money can reach the
beneficiary instantaneously and the beneficiary‘s bank has the responsibility to credit the
beneficiary‘s account within two hours.

c) Electronic Funds Transfer (EFT)

Electronic Funds Transfer (EFT) is a system whereby anyone who wants to make payment to
another person/company etc. can approach his bank and make cash payment or give
instructions/authorization to transfer funds directly from his own account to the bank account of
the receiver/beneficiary. Complete details such as the receiver‘s name, bank account number,
account type (savings or current account), bank name, city, branch name etc. should be furnished
to the bank at the time of requesting for such transfers so that the amount reaches the
beneficiaries‘ account correctly and faster. RBI (Reserve Bank of India) is the service provider
of Electronic Funds Transfer (EFT).

3.4.3 GIRO models operated globally

Page 18
Germany

 In Germany, GIRO refers to the provision of cashless payment and clearing operations.4 It is
considered as a banking activity requiring a licence from the German Federal Financial
Supervisory Authority except in the case of payment transactions conducted under special
laws as is the case of the Deutsche Bundesbank.
 The GIRO Networks in Germany for retail payments (cheques, credit transfers and direct
debits) include Central Cooperative Banks whose members are cooperative banks, Central
Savings Bank whose members are Savings Banks, commercial Banks whose members are
their own branches and other partner banks and GIRO Network of the Bundesbank with
banks as participants.
 Bilateral interbank clearing arrangements exist between the commercial banks, central
cooperative banks and Central Savings Bank in the retail payments.
 Inter-bank settlements are effected in the RPS of the Bundesbank (there are 251 active
participants in the RPS) or through bilateral clearing. The system is highly heterogeneous
with over two-thirds of the banks reportedly having bilateral arrangements.
 With about 0.4% in terms of volume and 0.6% in terms of value, cheque constitutes a
negligible portion of the use of retail payment instruments. Electronic credit transfers
represent over 83% of the value of retail payment instruments.
 There is no nationwide ACH that covers the entire payments market in Gerrmany. However,
the Central Bank reportedly offers its own ACH services to banks. It also provides paperless
processing of credit transfers, direct debits and cheque collection items through batch-
oriented clearing.

Singapore

 Interbank GIRO System (IBG) in Singapore is an offline interbank payment system which
caters mainly to low-value bulk payments. It is a paperless system which permits customers
of participating banks to transfer funds to/from the accounts of customers of any other
participating bank. Singapore Automated Clearing House (SACH) operates the IBG. Net
settlement amounts are sent by the SACH to MEPS (MAS Electronic Payment System) for
settlement at the end of the day. MEPS is operated by the Monetary Authority of Singapore.
 The majority of non-cash retail payments utilises IBG debit and credit transfers as well as
payment cards (stored value, debit and credit cards) and cheques. Bank customers can also
use their debit cards to make third-party account funds transfers and to pay bills via
automated teller machines (ATMs) and self-service kiosks. 5
 IBG is akin to the Electronic Clearing Service, both NECS and RECS, operated in India by
the RBI.

Page 19
Brazil

 One of the most innovative and popular payment method introduced in Brazil over two
decades back is the Boleto Bancario, also referred to simply as Boleto.6 The Boleto is
developed by the banks in Brazil in order to establish a universal exchange system which
allows customers to pay bills at any Brazilian bank. Boleto is regulated by the Brazilian
Federation of Banks (FEBRABAN).
 Boleto is essentially a Bar Coded Paper Voucher that providers of goods and services
(Billers) deliver to consumers to facilitate the payment of bills. Prior to issue of Boleto, the
Billers have to enter into a contract with their bank to obtain a Merchant ID and get
authorization to issue the Boleto. Consumers can also generate a boleto online. The format of
the Boleto was standardized more than two decades ago and contains all necessary
information to process the credit transaction.

The main participants in the Boleto payment method are:

i. Issuer Bank: The financial institution responsible for contracting with the Biller and the
issue of Boletos
ii. Biller: The Merchant who generates and delivers the Boletos to the customer to facilitate
payment and receives the amount collected (e.g. insurance, Essential bills, Utility bills,
etc.)
iii. Customer: Person who pays the Boleto
iv. Collectors: Bank branches, ATMs, Post Offices, Retail Agents etc. where the Boleto is
paid
v. Clearing House: Two interbank clearing houses, the Sistema de Transferência de
Reserves (STR) for transfers greater than $5,000 or Câmara Interbancária de Pagamentos
(CIP) for transfers less than $5,000.
 In the Boleto Payment method, a customer orders goods or services from a Biller, who sends
online or through post, a prefilled Boleto which contains the payment details in a
standardized bar code. The customer presents a physical copy of the Boleto at a collecting
agent and makes payment in cash or by card. The details on the Boleto are captured by the
collecting agent with the aid of a bar code reader. Clearing House completes the clearing and
settlement of the payment and the Issuing Bank credits the Biller‘s account and the Biller
fulfills the order.
 Over time, the banks signed up other retail channels allowing for payments to be made at any
authorized location including bank branches, post-offices, ATMS, lottery stores, etc. Forms
of payment include: cash, cards and cheques. Today, the Boleto system processes 40% of the
Brazilian bill payment market.
 Till the early 1990s, over 60 % of bills were being settled in cash, mainly at banks. This
arrangement suffered from operational inefficiencies affecting all stake holders viz. the
banks, the Billers and the consumers. To address the problems, large Billers made
arrangements to improve the bill collection system. However, these were bilateral

Page 20
 agreements between the Billers and the banks, and each bank had to set up separate links
with each Biller. The arrangement was complex and had significant drawbacks. In the year
2004, the Saudi Arabian Monetary Authority (SAMA) sought to integrate these networks by
setting up a centralized bill payment system SADAD, which provided a single platform
linking different Billers and banks.
 SADAD has significantly reduced the time spent by customers for paying bills. It has
reduced dependence on physical channels by facilitating online payments. At the same time,
it allows customers to use certain channels like ATMs, Phone banking and Point of Sale
Outlets (of any bank).
 SADAD has been widely embraced by banks and Billers and as of 2010, it had a market
share of over 91% of all the invoices generated in the kingdom. During the period 2003 –
2010, the use of bank branches for bill payments declined significantly from 73% to 6%.
 In the SADAD system, the Billers send summary of bill information to SADAD at pre-
determined schedules and SADAD uploads the same into its database after due validation
and notifies Billers of any discrepancies. A customer requests bill information through Bank
channel and SADAD retrieves the requested information and forwards the same to the
customer. The Customer selects the bill(s) to be paid, the payment instruction is carried out
by the bank by debiting the customer‘s account under confirmation to the customer. SADAD
updates its database based on the bank‘s confirmation and notifies the relevant Biller
accordingly.
 At the end of the day, SADAD initiates the settlement instructions through the Saudi Arabian
Interbank Express (SARIE) Billers reconciliation reports from SADAD on a daily basis
showing details of all transactions processed by SADAD.

3.4.4 A GIRO Model for India

The Committee discussed at length different GIRO payment models prevalent in the world and
their relevance and adaptability in the Indian context. The Committee acknowledged the
suitability of these models in the respective jurisdictions. However, it was felt that keeping in
view the need for a single, interoperable bill payment system as mentioned in para 2.13, the
―Boleto Bancario‖ model in Brazil and the SADAD model in Saudi Arabia have features that are
relevant to India, as they both enable acceptance of bill payments at multiple service points viz.
bank branches, ATMs , retail outlets etc.

While the ―Boleto Bancario‖ model is primarily a paper-based model involving printing of the
billing information in a standardized bar code form which needs to be presented at the time of
payment, the SADAD is mainly electronic and where the information on the bill is pulled from
the database of SADAD. Both the models provided an interoperable platform facilitating
payment of bills of all the Billers who subscribe to the systems. Both have succeeded in
streamlining the bill payment processes in their respective countries.

Page 21
Broad Guiding Principles underlying the proposed GIRO model: The Committee was guided by
the following principles in designing the bill payment model for the country:

 The system shall be aimed at larger public good.

 It shall align with the objectives of the Reserve Bank of India and the Government of
India to facilitate progress towards a less cash society.
 A major objective would be to migrate payments to electronic channels.
 It shall leverage on the existing payment infrastructure to the extent possible.
 It shall take into account the ground realities obtaining in the country and have a clear
migration path to the final desirable state.
 It shall retain and encourage competition among the participants providing services.
 It shall generate efficiency and ensure against monopolistic situations among the
participants.
 It shall provide commercial value to all the stakeholders.

After due deliberations, the Committee concluded that the GIRO model schematically
represented hereunder would adequately meet the gaps and inefficiencies observed in the
existing payment systems in India. The proposed system is expected to effectively meet not only
usual bill payment needs but also have the flexibility to enable one-off payments and person-to-
person fund transfers in the future. The Committee further felt that the new system, which is
largely aimed at bill payments in the country, needs to be appropriately branded to enable
identification and acceptance by the users and hence christened as the ―Indian Bill Payments
System (IBPS)‖.

3.4.5 Scope of the services at IBPS points

It is envisaged that the proposed system would enable IBPS points to accept payments from
public on demand raised by various entities which are linked to IBPS system. It is expected that
the IBPS Points would provide payment related service to the wide range of industries engaged
in providing services viz. Educational, Financial and Insurance, Government,
Telecommunications and Utilities, Transportation , etc. The services of IBPS points could be
used for payment/ collection of fees, insurance premiums, EMIs, municipal taxes, Govt.
Challans, business invoices deposits, bill, mobile top-ups, Bus/ Train ticketing, etc.

The benefits of the proposed model include:

1. Convenience:
a) The IBPS shall provide convenience to customers, Billers, other entities, Banks, etc.
b) It shall provide a customer/consumer the facility to initiate any payment transaction
(payments for bills, school/college fee, insurance payment, government payments etc.) from
any outlet participating in the IBPS.
c) It shall bring multiple Points of Presence (IBPS points) which would accept the bill payments
from consumers.

Page 22
2. Operational Efficiency:
a) The proposed system shall bring in interoperability among the various players which are
right now providing the services on stand-alone basis.
b) The Billers/businesses need not link separately with multiple aggregators/banks and may
have a single interface.
c) It would enable each bank to offer payment services for every Biller/businesses without
directly integrating with it.
d) It would move the billing industry and other businesses towards standardization of
billing/payment demand systems.
e) The proposed system would ride on existing infrastructure (cheque clearing, card payment
networks, etc.) to the extent possible so as to bring efficiency and quick implementation.
f) The system will enable broad-basing of aggregating business which may contribute to cost
and operational efficiency of the bill payment system.

3. Electronification:
a) It would give boost to electronification of payments and card acceptance for such payment is
likely to grow up.
b) It would prompt the billers/ businesses to electronify their billing systems.
c) It would act as a catalyst for e-commerce/ businesses in India and also support e-governance
initiatives of Governments.

4. Cost and Revenue benefits:

a) The proposed system would help the billers in reducing the cost of collection as fewer
resources would be required to build, operate and support the collection process.
b) It would lower capital expenditure for the Billers/businesses due to reduced investments in
infrastructure and software development.
c) It shall provide revenue stream for multiple stake holders which are engaged in providing
these services.

5. Authenticity:
a) Being a system authorised by the Reserve Bank of India under the Payment and Settlement
Systems Act, and with the help of a unique brand, logo and generation of verifiable unique
reference number the proposed system would generate trust among the consumers for
payments at the IBPS points.
b) The IBPS will have a guaranteed settlement arrangement which would enhance the
confidence of the billers and aggregators to enrol into the system.

Page 23
3.5 Tele banking
Telephone banking is a service provided by a banks and financial institution where customer
performs their transaction, over the telephone. Banking carried out over computer network is
called telephone banking.

It represents conducting financial transactions using computer and a telephone. Banking carried
out over computer network is called as Tele banking. Most telephone banking services use an
automated phone answering system. This technology facilitates to call the bank and give order to
a bank computer for carrying out of operation under your account.

4. Modes aiding implementation of Technology in Banking

4.1. Automatic Teller Machine (ATM)
Automatic Teller Machine is the most popular device in India, which enables the customers to
withdraw their money 24 hours a day 7 days a week. ATMs were introduced to the Indian
banking industry in the early 1990s initiated by HSBC. Most foreign banks and some private
sector players suffered from a serious handicap at that time- lack of a strong branch network.
ATM technology was used as a means to partially overcome this handicap by reaching out to the
customers at a lower initial and transaction costs and offering hassle free services. Since then,
innovations in ATM technology have come a long way and customer receptiveness has also
increased manifold. Development of ATM networks is not only leveraged for lowering the
transaction costs, but also as an effective marketing channel resource. It is a device that allows
customer who has an Automatic Teller Machine (ATM) card to perform routine banking
transactions without interacting with a human teller. In addition to cash withdrawal, Automatic
Teller Machines (ATMs) can be used for payment of utility bills, funds transfer between
accounts, deposit of cheques and cash into accounts, balance enquiry etc.

4.1.1. History of ATM:

The idea of self-service in retail banking developed through independent and simultaneous
efforts in Japan, Sweden, the United Kingdom and the United States. Luther George Simjian has
been credited with developing a "prior art device‖. The initial roll out of this machine called
Bankograph, in New York City in 1961 by the City Bank of New York, was removed after 6
months due to the lack of customer acceptance. The Bankograph was an automated envelope
deposit machine (accepting coins, cash and cheques) and did not have cash dispensing features.
The idea of a PIN stored on the card was developed by a British engineer working on the MD2
named James Goodfellow in 1965. It‘s also the earliest instance of a complete ―currency
dispenser system‖ in the history. Some of the giants in the current market are NCR Corporation
and IBM.

Page 24
4.1.2. Advantages of an ATM:

a) An automated teller machine increases existing business:

The typical ATM customer will spend 20-25% more than a non-ATM customer, according to
research conducted by AT&T Global Information Solutions.

b) An automated teller machine generates new business:

Customers are more likely to seek out a location with an automated teller machine; in addition to
convenience, there are a number of safety benefits associated with an in-store automated teller
machine.

c) An automated teller machine provides additional revenue streams:

Each atm withdrawal transaction generates surcharge income for the owner of the automated
teller machine. Additionally, an automated teller machine can provide revenue from on-screen
advertising, couponing, and alternative media (e.g., prepaid phone cards, postage stamps)
dispensing opportunities.

d) An automated teller machine reduces risk and lowers costs:

Having an automated teller machine on the premises can reduce the number of bad checks and
cut credit card expenses because customers have the option of withdrawing cash instead.

4.1.3. Disadvantages of an ATM:

a) Security

Unlike bank tellers, ATMs do not require the person performing the transaction to present a
picture identification. Rather, the person must only insert a bank card and enter a personal
identification number. If the bank card is stolen and the number ascertained, an unauthorized
person can easily access the account.

b) Inability To Perform Complex Transactions

ATMs can only perform relatively basic transactions. This means that people who need to
complete these longer transactions will be forced to use the teller, restricting use of the ATM for
people who need to complete simple business. In this sense, the ATM Is rather like the express
line in a supermarket--faster for some, but unavailable to others.

Page 25
c) Fees

With the advent of ATMs came ATM fees. Not only do banks of which you are not a member
charge fees for the use of their ATMs, but users are often charged surreptitious fees by their own
banks for using other banks' ATMs--meaning the customer is docked twice for the same
transaction.

d) Privacy

Unlike banks, in which security guards and tellers are present to ensure the person performing a
transaction receives privacy, there is no such guarantee when using an ATM. People may try to
spy on users as delicate information appears on the screen, without the user being aware.

e) Difficulty of Use

The performance of business at an ATM is generally quicker than that at a human teller.
However, the ATM is incapable of providing personalized instruction to the user in a way that a
human teller can. This can result in longer wait times if the user currently using the machine is
struggling to complete a transaction.

f) Eating a Card.

Occasionally, ATMs will malfunction and swallow a user's ATM card. The customer will then
be directed to contact a service number or their bank and wait for a repair technician to retrieve
this card. While this happens only rarely, if it occurs on a weekend or at night, the user may be
left to wait for several days before they can again use their card, something that would not
happen with a human cashier.

4.2. Point Of Sale Terminal

Point of Sale Terminal is a computer terminal that is linked online to the computerized customer
information files in a bank and magnetically encoded plastic transaction card that identifies the
customer to the computer. During a transaction, the customer‘s account is debited and the
retailer‘s account is credited by the computer for the amount of purchase.

4.2.1 Features of POS Terminal

 Save time and money.
 Increase transaction speed and quality of service.
 Faster transactions can be achieved by using a touch screen EPOS terminals.
 Easy to use touch screen EPOS allow products to be found quicker, operators can be lead
through a transaction and training times are often reduced.

Page 26
 Accurate billing.
 More efficient transactions - customers will get served quicker.
 Improve business efficiency and productivity.
 Take control - Back of house tools like EPOS Office and EPOS Sales will put you firmly in
control of your POS terminals, allowing quick and timely changes to products, retail prices
and menu‘s.
 Retailers can run targeted promotions such as happy hours, multi-buys or mix ‗n‘ match
offers like buy two get one for free, and maintain different price files for different outlets,
days of the week, times of the day or special events.
 Faster order processing.
 Better staff productivity - Orders are automatically relayed directly leaving staff with more
time to interact with customers.
 Reduced Paperwork - Use your POS system to reduce paperwork and save time doing stock
takes or reporting.
 Better cash control.
 Improve customer loyalty and retention.
 Build a list of your customers, collect their contact details and get to know them better.
 Targeted advertising offer incentives to your customers so they return on a regular basis.
Consider adding discount cards to your POS system or loyalty cards, gift cards and vouchers.
 CRM (Customer relationship management) tools can be used to communicate with your
customers allowing letter, SMS texts and emails to be sent out.
 Point of purchase advertising can be used to draw attention to items you wish to promote or
special upcoming events you may even be able to generate revenue from 3rd party
advertising.

5. Security in Banking
5.1 Features of Security
Security of a customer's financial information is very important, without which online banking
could not operate. Financial institutions have set up various security processes to reduce the risk
of unauthorized online access to a customer's records, but there is no consistency to the various
approaches adopted.

The use of a secure website has become almost universally adopted. Though
single password authentication is still in use, it by itself is not considered secure enough for
online banking in some countries. Basically there are two different security methods in use for
online banking. The PIN/TAN system where the PIN represents a password, used for the login
and TANs representing one-time passwords to authenticate transactions. TANs can be distributed
in different ways, the most popular one is to send a list of TANs to the online banking user by

Page 27
postal letter. Another way of using TANs is to generate them by need using a security token.
These token generated TANs depend on the time and a unique secret, stored in the security token
(two-factor authentication or 2FA).

More advanced TAN generators (chip TAN) also include the transaction data into the TAN
generation process after displaying it on their own screen to allow the user to discover man-in-
the-middle attacks carried out by trojans trying to secretly manipulate the transaction data in the
background of the PC.

Another way to provide TANs to an online banking user is to send the TAN of the current bank
transaction to the user's (GSM) mobile phone via SMS. The SMS text usually quotes the
transaction amount and details, the TAN is only valid for a short period of time. Especially in
Germany, Austria and The Netherlands, many banks have adopted this "SMS TAN" service.
Usually online banking with PIN/TAN is done via a web browser using SSL secured
connections, so that there is no additional encryption needed. Signature based online banking
where all transactions are signed and encrypted digitally. The Keys for the signature generation
and encryption can be stored on smartcards or any memory medium, depending on the concrete
implementation.
5.2 Attack on Security
Attacks on online banking used today are based on deceiving the user to steal login data and
valid TANs. Two well known examples for those attacks are phishing and pharming. Cross-site
scripting and keylogger/Trojan horses can also be used to steal login information.
 A method to attack signature based online banking methods is to manipulate the used
software in a way, that correct transactions are shown on the screen and faked transactions
are signed in the background.
 A 2008 U.S. Federal Deposit Insurance Corporation Technology Incident Report, compiled
from suspicious activity reports banks file quarterly, lists 536 cases of computer intrusion,
with an average loss per incident of $30,000. That adds up to a nearly $16-million loss in the
second quarter of 2007. Computer intrusions increased by 150 percent between the first
quarter of 2007 and the second. In 80 percent of the cases, the source of the intrusion is
unknown but it occurred during online banking, the report states.
 Another kind of attack is the so-called Man in the Browser attack, where a Trojan
horse permits a remote attacker to modify the destination account number and also the
amount.
 As a reaction to advanced security processes allowing the user to cross check the transaction
data on a secure device there are also combined attacks using malware and social
engineering to persuade the user himself to transfer money to the fraudsters on the ground of
false claims (like the claim the bank would require a "test transfer" or the claim a company

Page 28
 had falsely transferred money to the user's account and he should "send it back"). Users
should therefore never perform bank transfers they have not initiated themselves.

5.3 Preventing Security attacks.

There exist several countermeasures which try to avoid attacks. Digital certificates are used
against phishing and pharming, in signature based online banking variants (HBCI/FinTS) the use
of "Secoder" card readers is a measurement to uncover software side manipulations of the
transaction data. To protect their systems against Trojan horses, users should use virus
scanners and be careful with downloaded software or e-mail attachments.
 In 2001, the U.S. Federal Financial Institutions Examination Council issued guidance
for multifactor authentication (MFA) and then required to be in place by the end of 2006.
 In 2012, the European Union Agency for Network and Information Security advised all
banks to consider the PC systems of their users being infected by malware by default and
therefore use security processes where the user can cross check the transaction data against
manipulations like for example (provided the security of the mobile phone holds up) SMS
TAN where the transaction data is send along with the TAN number or standalone smartcard
readers with an own screen including the transaction data into the TAN generation process
while displaying it beforehand to the user (see chipTAN) to counter man-in-the-middle
attacks.

6. Impact of Technology
6.1. How technological changes has impacted customer.

 Online only banks give you 24-hour banking at any location you choose. All you need is
a computer, tablet or smartphone connected to the internet.
 You get higher interest rates for deposits when you bank online. In today's low-interest
world, that can make a difference.
 With the right online bank, you get all the services offered by traditional brick-and-mortar
banks. You can scan and deposit checks and transfer funds at any time on any day of the
year. There are savings and checking accounts available, as well as CDs, retirement accounts,
educational savings plans, loans and mortgages.
 The best online banks offer financing for several uses. That financing includes mortgages to
buy a home you've always wanted or a home equity loan for renovations to your house, or if
you need to pull some cash from your home's equity. You should be able to get an auto loan,
personal loan and even business financing.
 The first feature to look for in an online bank is FDIC backing. That means the government
guarantees your money for as much as $250,000, if your bank fails. The best online only
banks offer free transfers, online bill pay, mobile banking and telephone banking.

Page 29
 Convenience-Sometimes there just isn‘t enough time in the day to get everything you need-
to-do done, that‘s why convenience is one of the biggest advantages of online banking. With
business hours ranging from approximately 9am to 6pm, shorter hours on Saturday, and often
closed on Sundays, making a trip to the bank can easily become a difficult task for customers
with a regular 9 – 5 work schedule. Instead of running around town, trying to make it to the
bank before they close, just login online and get your banking done whenever it‘s convenient
for you.
 No Lines-One of the things most people dislike about banks is waiting in line. It is not
uncommon to find yourself waiting in line at a bank, waiting to be helped. By banking
online, you don‘t have to wait in line to get your baking done, leaving you with more time to
get other things done.
 Availability-With online banking, you can keep track of your money much easier because
your account information is available anytime online. To get your balance, simply login to
your account. Avoid getting stuck waiting for the bank to open again, having to visit an
ATM, or calling a time consuming customer service number to get the same information.
You can even save money, since some ATMs and customer service calls charge a small fee
to get your account balance.
 Innovation-If you are seeking a convenient and innovative way to handle your personal
finances, consider banking online. In addition to the advantages listed above many online
accounts include features like online bill pay which helps you save time and money when
paying bills. Many online banks also offer the convenience of checking your account
information from your cell phone. Check your balance by SMS or receive alerts when money
is withdrawn or a check clears. In many ways online banking provides a better experience
than a physical bank branch thanks to these new features.

6.2. The emerging role of banks in e-Commerce

6.2.1. How banks are facilitating e-Commerce growth.

Banks have an important reason to pursue the conduct of business on-line. If they fail to respond to the
opportunities posed by the Internet, they could be consigned to a largely secondary role as commerce
shifts toward electronics over time. In that event, they would process payments for buyers and sellers
engaged in e-commerce but they would have little chance to engage independently with buyers and sellers
or to offer their own products in the electronic marketplace. By contrast, if banks do establish a presence
on the Internet they should be in a position both to market traditional banking products more efficiently
and to develop and sell new products sought by e-commerce participants.

Page 30
6.2.2. Banks’ Changing Response to E-Commerce

A review of the banking industry‘s response to on-line commerce suggests that even as recently
as five years ago, banks‘ involvement with the Internet was quite limited. A bank might set up a
web site to provide consumers with information about its services. Actual banking transactions,
however, still took place at the branch, through the mail, by telephone, or over the automated
teller machine (ATM) network. In the last few years, however, many banks have begun to use
the Internet as a supplementary channel for delivering traditional products to consumers and
businesses. Some banks are also investigating how they might expand their current service
offerings to include some products designed exclusively for e-commerce.

6.2.3. Electronic Delivery of Traditional Banking Products

Many banks have established transactional web sites where individuals and businesses can
perform many basic banking functions such as checking balances, transferring funds, or applying
for credit cards. Small businesses can apply for loans, initiate wire transfers, and take advantage
of cash management and payroll services. When limited to such services, these web sites
function as another access channel for basic banking services—one that is not all that different
from the branch networks or telephone centers maintained by banks except that customers use
personal computers and the Internet to communicate with their banks. The transactional web
sites offer banks and their customers notable advantages. Customers are attracted by the
convenience of this access channel, while banks welcome the cost savings that arise when
customers perform the transactions themselves rather than dealing with a bank representative at a
teller window or over the phone. A recent estimate suggests that between 6 million and 7 million
consumers are banking on-line, with high rates of new users interested in this service.

6.2.4. Facilitating Business-to-Business e-Commerce

A few of the largest commercial banks have begun to offer firms the technology for electronic
business-to-business commerce. These banks are essentially undertaking to automate the entire
information flow associated with the procurement and distribution of goods and services among
businesses. From the banks‘ perspective, this service is a natural extension of the automated cash
management services they already provide to large corporations.

Page 31
6.2.5. Issuing Electronic Money and Electronic Checks

Two e-commerce products still in the planning stage are electronic money and electronic
checks. As more computers become equipped with ―smart card‖ readers, banks are considering
issuing electronic money that could be stored on these cards and spent over the Internet. In
addition, a banking technology organization is working with the U.S. Treasury and some banks
to test an electronic version of a paper check. The check could be sent over the Internet from a
buyer to a seller, electronically endorsed by the seller, and then forwarded on-line to the seller‘s
bank for electronic collection from the buyer‘s bank.

6.2.6. Integrating the ATM and Internet Networks

Some technology companies and a banking technology group are exploring the feasibility of
allowing access to the Internet and to bank web sites from ATMs. If the integration of these two
networks can be accomplished, consumers should be able to use ATMs to engage in e-commerce
or to conduct their banking in the flexible environment of their bank‘s web site.

6.3. How Technology is enabling Financial Inclusion

Objective of Financial Inclusion is to provide Bank Account to every household in the country
and make available the basic banking services facilities i.e. (i) Opening of Bank Account with
RuPay Debit Card & Mobile Banking facility, (ii) Cash Withdrawal & Deposits, (iii) Transfer,
(iv) Balance Enquiry & (v) Mini Statement. Other services are also to be provided in due course
in a time bound manner apart from financial literacy which is to be disseminated side by side to
make citizens capable to use optimum utilization of available financial services. To provide these
banking services banking outlets to be provided within 5 KM distance of every village.
Necessary infrastructure also needs to be placed to enable e-KYC for account opening and AEPS
for withdrawal of cash based biometric authentication from UIDAI data base.

For fulfilling this objective Indian government has launched PMJDY which is to be executed in
the Mission Mode, envisaging provision of affordable financial services to all citizens within a
reasonable distance. It comprises of the following six pillars:-

a) Universal access to banking facilities

Mapping of each district into Sub Service Area (SSA) catering to 1000-1500 households in a
manner that every habitation has access to banking services within a reasonable distance say 5
km by 14 August, 2015. Coverage of parts of J&K, Himachal Pradesh, Uttarakhand, North East
and the left Wing Extremism affected districts which have telecom connectivity and

Page 32
infrastructure constraints would spill over to the Phase II of the program (15 August, 2015 to 15
August, 2018)

b) Providing Basic Banking Accounts with overdraft facility and RuPay Debit card to all
households
The effort would be to first cover all uncovered households with banking facilities by August,
2015, by opening basic bank accounts. Account holder would be provided a RuPay Debit Card.

Facility of an overdraft to every basic banking account holder would be considered after
satisfactory operation / credit history of six months.

c) Financial Literacy Programme

Financial literacy would be an integral part of the Mission in order to let the beneficiaries make
best use of the financial services being made available to them.

d) Creation of Credit Guarantee Fund

Creation of a Credit Guarantee Fund would be to cover the defaults in overdraft accounts.

e) Micro Insurance

To provide micro- insurance to all willing and eligible persons by 14 August, 2018, and then on
an ongoing basis.

6.3.1 Role Of Technology In Financial Inclusion

1. Technology and financial inclusion are the popular coinage in banking parlance in the
country. Main hurdle in financial inclusion so far has been large numbers and low volumes,
translating into unaffordable costs. The only way to bring down the cost to an affordable
level and to improve the reach to the farthest / remotest corner of the country is by effectively
leveraging the Technology.
2. In order to make available the banking facilities across the length and breadth of the country,
latest technological products like e-KYC, IMPS, AEPS, mobile banking etc. have the
potential to emerge as a game changer in terms of costs, convenience, and speed of reach.
Business models of banks, telecom operators and other stakeholders need to converge.
3. Under the guidance of RBI various organisations like National Payments Corporation of
India (NPCI), Institute for Development & Research in Banking Technology (IDRBT) etc.
are contributing significantly in bringing new technology based products.
4. Reserve Bank has, thus, been actively involved in harnessing technology for the development
of the Indian banking sector over the years. A major technological development in banking
sector is the adoption of the Core Banking Solutions (CBS). CBS is a step towards
enhancing, customer convenience through, Any-where, Anytime Banking. It is important to
leverage this technological advancement to look at areas beyond CBS that can help in not

Page 33
 just delivering quality and efficient services to customers but also generating and managing
information effectively. The adoption of CBS led to various technological products like
NEFT, RTGS, mobile banking, Internet Banking, ATMs, etc. Some of the Technological
based products have made significant changes in the banking outreach to the masses are
appended below:

 Adopting core banking solution (CBS) by the Banks, including all Regional Rural Banks
(RRBs). Next a multi-channel branchless approach using hand held devices, mobiles, cards,
micro ATMs and kiosks can be used.
 Transactions put through such front-end devices are seamlessly integrated with the banks'
CBS.
 Implementing of the electronic payment system such as RTGS (Real Time Gross
Settlement), Electronic Clearing Service (ECS), Electronic Funds Transfer (NEFT), Cheque
Truncation System (CTS), Banking transaction by using Mobile phones etc.
5. The present plan of the PMJDY under National Mission on Financial Inclusion proposed to
use the Technology in a big way to achieve the goal in a time bound manner. Some of the
major products are appended here under:
 Electronically Know Your Customer.
 Transaction through Mobile banking.
 Immediate Payment System(IMPS).
 Micro-ATMs.
 National Unified USSD Platform (NUUP).
 RuPay Debit cards.
 Aadhar enabled payment systems.
 Aadhar payment Bridge system.

Page 34
7. Negative Impact of Technology in Banking
The world has come from far and we are every day digging into the unknown, what was
unthinkable then is now a practice. Today, you can bank right from the comfort of your home
and multitudes of benefits come with it. However, though internet banking is such a good and
desirable innocent, it has some disadvantages as listed;

A. Legal issues: If you and your spouse wish to view and manage your assets together online,
one of you may have to sign a durable power of attorney before the bank will display all of
your holdings together.
B. Learning difficulties: Banking sites can be difficult to navigate at first. Getting acquitted
with the banking sites software may require some time to read the tutorials in order to
become comfortable in your virtual lobby.
C. Site changes and upgrades: Even the largest banks periodically upgrade their online
programs, adding new features in unfamiliar places. In some cases, you may have to re-enter
account information. If you need help, you might encounter a lengthy wait when using the
bank telephone customer service line.
D. Customer service: There is no personal contact with any of the staff, and if talk to any staff
through the telephone, you have guarantee you are talking to the best person
available. Personal relationship with the staff at the banks comes handy when requesting for
faster loan approval or a special service which may not be available to the public. The
manager has many discretionary powers such as waiving of penal interest or service fees
which were often taken advantage of by better acquaintance with the staff. Additionally
personal contact also meant that the banker would provide essential financial advice and
insights which are beneficial to the customer.
E. Money usage: You can‘t spend your money from the online bank accounts you wish, in the
end; you will need to go to an ATM to withdraw money for usage.
F. Technical breakdowns: As with all technologies, online banking websites sometimes go
down. If this happen when you closed your local bank or credit card accounts, you will
definitely go penniless.
G. There will be 3 problems in terms of internet banking or card payment system. For example
if a person is buying a product and payment is made through internet, either my bank server
goes down or payment gateway server (Provided by third party) goes down or the vendor‘s
server goes down. If any of these servers go down, then the transaction fails.
H. Site Disruption: A technical glitch could cause the bank & website to go offline for a period
of time, possibly resulting in problems for you and your business. For example, you may
need immediate funds after normal banking hours to make a payment or emergency business
purchase. Routine site maintenance also occurs, although this normally takes place during
off-peak hours.

Page 35
I. User Apprehension: Some business owners may not feel comfortable with the idea of
placing vital financial information into an online account, or may be apprehensive about
using the Internet. If you are a longtime small business owner who is used to doing banking
in person or even by telephone, this hurdle might be difficult to surmount.
J. Accessibility: If your business is located in a rural or remote area, your Internet options
could be limited. Depending on your type of business, this can make conducting transactions
difficult. For example, if you operate a home-based business and you don‘t have access to a
high-speed cable connection, you may have to use a slower dial-up service. As a result, your
business banking may take more time, or you might even experience times where you can get
online.
K. Security concern: Even though online banking sites are heavily encrypted, with the
developing technology, it‘s hard to rule out the "hackers" who may access your bank
accounts. This can lead to fraudulent use of your business identity and potentially cost you
thousands of dollars. We further elaborate this in detail

8. Security Issues in Online Banking

Delicate information such as personal data and identity, passwords are frequently related with
personal property, secrecy and may present security concerns if leaked. Illegal right of entry and
usage of private data may result in consequence such as identity stealing, as well as theft of
assets.

8.1. Various modes of Online security threats

a) Phishing: Phishing is a kind of scam where the scammers masquerade as a trustworthy

source in attempt to gain private data such as PINs, and credit card data, etc. through the
internet. Phishing frequently happens through prompt messaging, email and it fools the
user by showing any financial fake site in its actual format. These forged websites are
frequently planned to look identical to their genuine counterparts to avoid misgiving from
the user.

b) Internet scams: Internet scams are patterns that betray the user in several ways in attempt
to take benefit of them. This attacks are created to make the fraud with private assets of
customer directly rather than personal data through false undertakings, assurance tricks and
more.

c) Malware: Malware, mainly spyware, is malicious software camouflaged as legitimate

software planned to accumulate and transmit private data, such as PINs, without the
customer's consent or knowledge. They are often spread through software, e-mail and files
from unofficial places. Malware is one of the most prevalent safety apprehensions as
frequently it is impossible to decide whether a file is infected, in spite of the source of the
file.

Page 36
d) Identity theft: Identity theft is a crime in which a fraudster obtains key pieces of personal
data, such as bank information, date of birth or driver's license numbers, in order to
impersonate somebody. The personal data exposed is then used criminally to apply for
credit, buying goods and services, or gain right of entry to bank accounts.

e) Investment or share sale (boiler room) fraud: Boiler room fraud is a attack in which
illegal or aggressive mis-selling of bogus, valueless or vastly expensive stocks are takes
place by share fraudster. If the victim mistakenly invest money with this fraudster, he will
surely lose his all money invested.

f) Keystroke capturing/logging: Keystroke capturing or logging attacks are takes place with
the help of software or hardware key logger. Anything that user type on system can be
captured and stored in a storage. This actually create a log file of user activities and at a
particular instance of a day mail is automatically forwarded to the attacker. This log file
contains id and password of different users and attacker can use this for his own purpose.
This attack mainly takes place at internet cafes. An updated antivirus and a good firewall
can protect any system from this types of attacks.

g) Lottery fraud: In this type of fraud attacker send fake letters or e-mail messages, which
recommend the user that he have won a lottery. To take the benefits of this, they are asked
to respond email message with some private banking information of victim,this include his
bank account details, complete personal information. Then, after getting this mail from
victim attacker can use this information to commit further fraud.

h) Pharming: In Pharming attack fraudster create false website, so that people will visit them
by mistake. This attack takes place when user mistype a website or a fraudster can redirect
traffic from genuine website to a fake one. The main purpose of pharmer is to obtain
victims personal information for further frauds.

i) Spyware: Spyware can enter in any system as hidden components of free programs. They
can monitor web usage, keystroke logging and virtual snooping on user‘s computer
activity.

j) Trojan horse/Trojan: Trojan horse are the most dangerous type of attack in which
attacker can directly gain unauthorized access to victims systems. This virus enters in
victim system with the help of different legitimate software. An updated antivirus and
firewall can protect any user from this kind of attacks.

k) Virus: Virus is a computer program that designed to replicate itself from one computer to
another. It can slow down user system or corrupt its memory and files. Email and file-
sharing facilities are the main reason for spreading viruses.

l) Worm: It‘s a malicious program that replicate or reproduce itself until all the storage space
on a computer drive will be filled. It uses system time, speed, and space when duplicating.
It can also interrupt internet usage.

Page 37
8.2. Present Security Systems for Online Banking

a) User id & Transaction Password: Firstly, New York introduces online banking using
user id and text password in the early 1980s. To access online banking facilities, a customer
have to register him-self with a unique id and password for user verification. The new User
id must be 6 to 19 characters and the password must be 8 to 17 characters and must contain
at least 2 alpha and 2 numeric characters. Customer can set security data to email address,
Security Queries, Authentication Pass Phrase & Computer Registration. Now, user can
access and take full benefits of internet banking services.

b) OTP: One-Time Password (OTP) Service Using Mobile Phone Applied to Personal
Internet Banking was implemented first time in japan, 2007. This is an authentication
service that makes use of an OTP in addition to the conventional ID and password for
personal identification. User can use this OTP for better security during online transaction
by downloading special password-generation software to their mobile phone. User can
perform authentication by entering an OTP displayed by the mobile phone application in
addition to their normal ID and password. The one-time passwords are specific to each
user, and a new password is generated every minute. Even if the password is obtained by a
third party fraudulently, it cannot be used outside its lifetime.

c) QRP code: QRP that is Quick Response Protocol, is a secure authentication system that
uses a two factor authentication by combining a password and a camera equipped mobile
phone, where mobile phone is acting as a authentication token. It is very secure and also
very easy to use for encrypted data. It is very secure protocol for use on untrusted
computers.

d) Biometric: Biometric is specifically used for secure ATM transaction. In such a

transaction, the use of a biometric mechanism such as iris/retinal scan, hand geometry or
fingerprint scan can greatly improve overall security. All customers need to do is register
their biometric information at a bank‘s branch. Then they will be able to withdraw money
from ATM by just providing their biometric password and providing their date of birth and
Pin number. Currently there are 80,000 biometric enabled ATMs in japan used by more
than 15 million users.

e) OTP and QR code: To eliminate threat of phishing and to confirm user identity the system
with the combination of OTP and QR code was developed. QR-code can be scanned by
user mobile device which overcome the weakness of traditional password based system.
This improves security by using one time password (OTP) which hides inside QR code.

f) Grid Authority Card: Grid authority Card is a card that helps in preventing the fraud at
the initial stage itself such that the fraud could not take part. In this system, the customer
submits his/her credit card credentials along with the respective Grid Characters on the grid
card associated with the credit card. Grid card contains the alphabets associated with the
numeric numbers printed on it. These grid codes are generated randomly by the user
interface application through which the customer is connecting to the Payment Gateway via

Page 38
 secure internet connection. Without the Grid Card, no one can do the online payments in
case of credit card theft or lost.

g) E-Token: E-Secure Token provides an additional security feature when logging on to

Internet Banking. The eSecure Token provides a ―One-Time-PIN‖ (OTP), which should be
used to access the Internet Banking sites, together with username and password. Each OTP
is only valid for one session; therefore the E-Secure Token should be used to generate an
OTP with every login. To obtain login OTP user have to switch on his E-Secure Token
using the On/Off Button. Then he have to enter his 4 digit secret pin. User‘s E-Secure
Token LCD screen message will then display his login OTP.

h) Security Question: Based on research for multifactor authentication (MFA) and fraud risk
mitigation, the verification process was strengthened for Internet Banking users by
reducing the number of opportunities to correctly answer security challenge questions.
Previously, users selected three security challenge questions to be presented during MFA,
and had up to five prospects to correctly answer those questions. Specifically, a user was
presented the first security challenge question and had two opportunities to answer
properly. If the user didn‘t provide the correct response, the second safety challenge
question was presented and the user again had two opportunities to provide the correct
answer. If the user was still unable to offer a correct response, the third safety challenge
question was presented and the user had one opportunity to respond correctly. At that time,
if the user was incapable to answer correctly, the customer was locked out of Internet
Banking until customer service unlocked or reset the MFA setting for the user.

9. Recent Trends in Technology for Banking services

9.1 Cloud Computing for Small Size Urban Co-operative banks
Cloud Computing has become ubiquitous concept in Information Technology arena and is
widely agreed to be the key to future of IT. National Institute of Standards and Technology
(NIST) has defined cloud computing as:
"Cloud computing is a model for enabling convenient, on-demand network access to a shared
pool of configurable computing resources (e.g., networks, servers, storage, applications, and
services) that can be rapidly provisioned and released with minimal management effort or
service provider interaction.‖
As per NIST definition, cloud computing needs to satisfy five essential characteristics, use one of
the three service models and deploy using one of the four models viz. Public, Private, Hybrid or
Community.

The five essential characteristic are (a) On demand self-service i.e. provisioning of additional
computing facilities without human intervention (b) Broad network access i.e. accessibility from

Page 39
a variety of devices (c) Resource pooling i.e. sharing of infrastructure like data centre, hardware,
infrastructure software and application software across banks (d) Rapid Elasticity i.e. resources
allocated to a bank can grow or shrink dynamically depending upon load and (e) Measured
service i.e. pricing would be based on actual usage rather than cost of equipment.

Many Urban Cooperative banks have been providing IT support to other cooperative banks
which included sharing of Data Centre and DR sites, Automated Teller Machines, Payment
gateways. Some of these banks are also providing their software solutions as outright sale or fees
based ASP model. It is observed that two leading software firms had been also offering cloud
like services which included core banking as well as many other solutions such as HR solutions,
e-mail, storage, etc which the banks could choose. These services are mostly on private cloud
like set up.

As both Bank provided as well as Software Developer provided cloud like solutions are in use
among the Urban Cooperative banks, such solution provide an opportunity for further use.
However, there are security concerns which are still not resolved. The processes for cloud
accreditation, Cloud audit assurance, etc. are required to be developed. Issues relating to Cloud
Governance, data security and privacy for banks customers, etc. are not yet fully examined.

Keeping in view the limitations of the target banks, evolving nature of technology, open issues
and security concerns, caution is recommended while adopting cloud computing solutions till all
issues are understood and resolved.

Compared to commercial banks, the size, scale of operations, skill set availability, preparedness
for computerization of Urban Cooperative banks are not high. Yet, there is need for
computerization by adoption of Core Banking Solution (CBS) by these banks to derive greater
reach and provide better services.

 For a bank to adopt CBS on its own, it needs a minimum threshold limit in terms of number
9.1.1 Recommendation on adopting Cloud Computing.

of branches, customers and number of transactions. It is possible for bigger Urban

Cooperative Banks to adopt this approach.
 For those UCBs, which cannot go for their own CBS, there are services models available.
These service models are broadly termed as cloud services.
 In cloud services, a service provider builds necessary resources in terms of hardware and
software and allows individual banks to use them for a fee. The fee could depend on various
factors like size, volume etc. As on date, two leading software solution providers are
providing these services at a fixed cost.
 The cloud technology is relatively new and is evolving. The issues relating to data
confidentiality, security etc is yet to be completely established.

Page 40
 Further, there is excessive dependency by several banks on the service provider for all
services. So drafting legal agreements etc. has to be fully considered.
 Another dimension to the issue would be multiple service providers. Unless there are
standards for both data and application, it would be extremely difficult to have systems that
can talk to each other. More importantly for banks to move from one service provider to
another.
 There is lack on standardization in cloud computing terms of Security, Service Level
Agreement, portability and interoperability, audit and accreditation.

Conclusion
Depending on size and financial status, UCBs can adopt either CBS of their own or draw
services from service provider. DG desired that an approach paper for adoption of CBS/Cloud
services may be prepared by DIT.

Cloud computing offers benefits to consumers in terms of converting their capex to opex and
improve business agility by deploying and testing application and reaching to market in no time.
But such benefits come with varied risks like risk of business continuity, SLA risk, portability
and interoperability issues and disaster recovery.

9.2 Advanced Data and Analytics in Banking Services

Many financial-services companies and other consumer-facing businesses outside Asia are
successfully using ADA to unlock customer value. But some Asian bankers are asking how
ADA differs from CRM before they invest in this approach.

For many banks, CRM was about an IT solution as a repository for all relevant customer data.
Some banks went further and applied heuristics for customer campaigns based on the bank‘s
data. Classic applications of CRM in banking include cross-selling to existing customers and
proactive and reactive churn programs. ADA pushes this further, for example, by using
sophisticated next-product-to-buy algorithms based on Bayesian models to ensure that cross-sell
offers are done with the right product at the right time. Some ADA techniques are possible today
thanks to advances in computing power and a lower cost of data storage. While ADA builds on
CRM, it differs from it in four areas:

(i) Using new forms of data

Today, banks mainly use internal structured data like balances, transactions, product holdings,
and customer demographics. In the future, banks will use both internal and external data (such as
from loyalty programs of partners), as well as structured and unstructured data (for instance, call-
center records). Additionally, increased use of social networks creates more marketing and sales
opportunities (where privacy laws and other regulations permit).

Page 41
(ii) Employing statistical models instead of heuristics

Many banks now use heuristics for their campaigns. For example, based on the experience of
their salespeople, they may assume that one customer segment, say, urban males between 28 and
35 years old with an income of INR 75,000 to 100,000 a month, are more likely to buy a certain
product. So, in a sense, banks are using experience-based decision rules with simple
demographics and information. In the ADA world, banks are employing a hypothesis-driven
approach to create hundreds and, in some cases, thousands of new variables (such as the velocity
of balance changes or a concentration of locations of withdrawals) that they then test with
statistical models to enhance their ability to locate the most attractive micro-segments. The result
can be a doubling or tripling or even more of product-purchase hit rates.

(iii) Speeding up response time

ADA decreases response time by identifying and computing in real time the variables that matter
to make tailored offers. Using this, banks are now able to make almost instantaneous offers to
customers when they call or when they visit specially designed landing pages on Web sites.

(iv) Increasing the level of tailoring and personalization

While marketers have long talked about personalized offerings and interactions, ADA allows
banks to embrace these, using better computing power and more sophisticated models. This is a
step change from marketing to relatively large sub-segments such as ―affluent rate hunters‖ or
―young families.‖

10. Recommendations for strengthening Cyber Security

Issues with Cyber Security:

Cyber security is a top priority for CEOs, CIOs, and boards of Asian financial-services
companies. A recent study by McKinsey and the World Economic Forum revealed that 80
percent of global banking IT executives believe that the risk of cyber attack is a significant issue
that could have major strategic implications over the next five years.

Many organizations have experienced sophisticated cyber attacks. Malevolent actors send e-
mails to individuals, including innocent-looking but virus-infected files that appear to come from
CEOs. This form of ―social engineering‖ increasingly makes use of social-media channels to
target unsuspecting users. They use public sites to distribute malware. And they employ other
techniques to gain access to and move freely within company networks, often for months before
detection, in the process obtaining financial-transaction data, intellectual property, business
plans, and customer-account credentials.

Page 42
Cyber-fraud risks are acute in the financial-services sector because ―that‘s where the money is,‖
to paraphrase the famous 20th-century American bank robber Willie Sutton. Banks are
witnessing the rise of transnational cyber-fraud syndicates that hack customer accounts and
siphon money from unwitting users. China lost $46 billion in 2012 through cybercrime 40% of
total global losses, according to Symantec, a leading security-management and solutions
company. In Japan, the average cost of a data breach is more than $2million per incident,
according to the Ponemon Institute. In addition, cyber enabled fraud losses are spurring
regulators to take action constraining banks‘ operations. For example, a recent spate of breaches
enabling fraudulent ATM transactions has led regulators in Hong Kong and Singapore to push
banks to require users to set limits on online transfers and overseas transactions.

Many financial institutions are spending more on cyber security and have beefed up their overall
anti-cyberfraud efforts. They are employing increasingly sophisticated approaches to the
problem, such as monitoring network activity. They are also investing in cyber-operations
centers, which are meant to provide a better view of threats from the outside world. In Japan, for
example, many financial institutions are beginning to work with the Japanese Computer
Emergency Response Team Coordination Center, an independent, nonprofit organization, to
circulate information on known cyber-threats.

These approaches are adequate, but they don‘t go nearly far enough. Even sophisticated
organizations still suffer from breaches, and companies are failing to reach the cyber security
goals they set for themselves. A McKinsey survey of 50global companies recently showed that
none have been able to reach their desired capability level, with only 14 percent of those
surveyed rating themselves as ―mature‖ across critical cyber security practices (mature
representing a score of 3 on a scale of 1 to 4 in eight practice areas).

The issue is that current approaches are passive—companies are usually only on the lookout for
known threats, waiting for sensors to trigger alarms indicating that an incident may have already
occurred. The approaches are often backward-looking, mostly relying on assessments of past
attack patterns. And they do not sufficiently involve business leadership, particularly when log
reports of Web site attacks, malware, or suspicious activity are not translated into something
executives of the businesses can understand.

For example, in one bank, executives were routinely briefed on the number of alerts generated by
their intrusion-detection system but were not informed if these ―intrusions‖ were having any
impact on the business, leaving them unclear about the true nature of the cyber-risk facing them.
Most important, these approaches provide too many false positives—alarms that upon second-
level analysis turn out not to be malevolent activity—and are too reliant on large numbers of
cyber security professionals to examine log reports and compare them with known bad IP
addresses or signatures before taking specific actions such as blocking IP addresses or closing
ports. These approaches are not scalable because the talent required to staff these positions is

Page 43
either unavailable or too costly, or both, given how many financial institutions have the same
needs.

Asian banks need a new approach, one that avoids large staff increases and is better able to use
existing security assets, such as fraud-detection units, compliance and risk resources, and
business-operations managers. The key is combining old and new to automate the security-
response process. The approach melds the tried-and-true practice of focusing efforts on the
highest-value business assets with application architecture and network-activity monitoring to
detect anomalous patterns (particularly systems changes or outbound network traffic). The result
is an environment that can largely take care of itself, freeing up valuable IT security resources to
focus on more strategic issues, such as reducing the impact of cyber incidents, and to ensure that
the resources are available when incidents do get past the system.

10.1 Recommendations on ways to Strengthen Cyber security:

a) Identification of critical business assets:

The first step is also the one least taken of the seven. Security assessments are usually done from
a technical point of view, focusing on gaps or applications that don‘t follow policy. This leaves
open the question of what are the most critical business assets, meaning they may go
unprotected. For banks, this suggests that security is not focused on areas like proprietary trading
algorithms, sensitive data related to underwriting, or risk reports, which could result in material
losses and cause significant reputational risk if they were made public.

b) Development of strategies for assets and ‘use-based triggers’:

Based on the assets that need protection, an overall strategy can be defined by identifying
practices and technologies to use. Then, for each critical asset, an expected access profile can be
developed.

The key is keeping the list of critical assets and access entitlements manageable. This might
include determining who can access the information or process, and what the range of expected
behavior is (for example, how the information might be expected to move within the network).
Triggers can also be set for monitoring certain kinds of activity, such as changing operating
systems or Domain Name System entries. For each trigger, actions can be predetermined,
ranging from simply logging an alert to shutting down a system. Over time, machine learning
will allow these triggers to become more effective. Meanwhile, the organization must be clear
about which outcomes are unattractive (downtime in a customer-facing application, for example)
and which are unacceptable (such as loss of ―bet the company‖ intellectual property); sometimes,
unattractive outcomes will be acceptable. In addition, in some countries, the triggers should be
defined so they are not interpreted by government authorities as monitoring individual behavior.

c) Employing existing processes:

Banks and other financial institutions have effective processes to reduce fraud and manage
financial risk. However, in our experience, they typically underestimate other forms of cyber

Page 44
security risks. Leading banks are beginning to move beyond fraud and include other cyber-risks,
such as theft of privileged information—M&A data, proprietary algorithms, and customer
information—as part of their enterprise-risk-management program. In addition, when cyber-
fraud risk is assessed, it is often not fed back to the information-security team so that the unit can
design specific mitigation actions. When the process is redesigned, more effective reviews are
done, and IT security can then effectively use risk estimates already being done by other parts of
the bank.

d) Enhancing the IT environment:

In the short term, technology such as sensors and network appliances is useful for detecting
anomalous activity, tightening access control, and appropriately encrypting critical data. Over
time, security reviews could be used to increase standardization, making it easier to detect
anomalies as well as reduce cost. IT architecture can also be dynamically switched to
dramatically reduce the ability of hackers to take or tamper with information—for example,
through cloud infrastructure that moves everything from network switches, servers, and data-
management strategies to a virtual, software-based infrastructure. In addition, architectures
increasingly need to be adapted to secure the mobile environment. As more banking transactions
are conducted through mobile devices, the secure delivery of this channel is emerging as a
differentiator.

e) Employment of active defense:

There are a variety of techniques under development to stop attacks from occurring. These
include defusing distributed denial-of-service attempts, throttling bandwidth from known
attackers, creating ―honey pots‖ of seemingly valuable information in order to gather information
about attackers while diverting them from their intended targets, and developing multisource
threat-intelligence capabilities that draw from external and internal information sources to
provide warnings of malevolent activity before an incident actually occurs.

f) Sophisticated testing and war gaming to ensure a strong response:

Most organizations put 90percent of their cyber security effort into prevention, but developing a
cross-functional approach to respond to and mitigate the damage from an attack and regularly
practicing it is as important. A poor response can damage a company‘s reputation and potentially
destroy additional business value. War-gaming a response can help minimize problems such as
slow decision making in the ―fog of war‖ during an attack, ad hoc release of messages to internal
constituents, poor communication with regulators, and an unsophisticated or uncoordinated
media response. Best-practice organizations train and test business, corporate management, and
IT and security professionals on how they will respond to attacks. They define their general
communication plan as well as what their approach to critical clients would be during an outage,
and train their staff to manage a crisis using scenarios based on actual cyber vulnerabilities.

Page 45
g) Tailoring business and employee engagement to build the right culture and mitigate
insider threats:
Of course, employees are vulnerable to phishing or other attacks, and up to two-thirds of all
advanced external attacks leverage unwitting insiders. Similarly, the risk of malicious insiders
remains of significant concern. While putting in place the elements described above, financial
institutions should take the internal risk seriously and offer targeted, role-based training as well
as continuing education to the broad base of employees about how to manage data safely. In
addition, organizations should increase their ability to detect and defend against the threat of
malicious insiders stealing or corrupting data or code. For example, several financial institutions
are applying advanced-analytics approaches to identify anomalous behavior by employees (such
as accessing databases outside normal hours or using portable media). They are also regularly
reviewing the retention risk of important employees: research by Verizon has shown that
70percent of all insider theft is committed by employees who are within 30days of leaving the
organization.

The threat from cybercrime is real and pernicious. Asian banks and other financial institutions
must move from an alert- and reaction-based approach to one where they anticipate and hunt for
malicious activity affecting their most critical assets. While no approach will deliver 100percent
security, adopting the principles described above will help banks to detect and thwart adversarial
activity, improve the efficiency and effectiveness of their security organizations, and ensure a
more robust response to a breach.

11. Recommendations for Technology adoption in Banking

services
Research on ways of adopting technology shows that rather than reducing branches, banks are
transforming them into centers. Focused on serving specific customer segments, the centers are
strategically located in the micro-markets where these customers live and work. The centers tend
to be modeled on three formats:

a) Wealth-management center. This physical channel caters to affluent customers who need
high-touch services beyond retail banking, such as estate planning, investment management,
and legal and tax advice. For many banks, one-to-one interactions with high-net-worth
individuals yield the most product sales. To serve this segment, a bank must redesign the
branch‘s physical space and alter its organization to include more specialized RMs.
b) SMB center. This center delivers business-focused products and services to private-business
owners. Services include professional advisory on topics such as financing and capital-
raising strategies, supplier and vendor management, and cash management. In some cases,
these customers may also need asset- and wealth-management services. Some banks are
uniting asset- and wealth-management services and SMB services at one physical center.

Page 46
c) Digital showcase center. A few innovators are transforming branches into centers that
showcase their mobile and digital capabilities. While these centers tend to have a non-
banking, tech-driven look and feel, they fulfill the bank‘s need for a physical presence to
attract customers. At the same time, they serve as a testing ground for those customers who
are increasingly reliant on mobile but not completely proficient in its functionality.
Particularly prevalent in highly populated areas, such as Hong Kong and Singapore,
showcase centers feature multiple screens and devices where customers can test, play, and
learn with support from staff. This format, however, is yet to be proven as economically
sustainable.
By analyzing its customers, a bank can determine which center format is best suited to the
needs of its specific customer segments. A number of banks are employing all three formats
in carefully selected micro-markets. The question for Indian banks becomes how many
branches they should transform, which types of centers should be used and in what
combination, and which specific geographic areas they should target.

11.1 Suggestions for Adopting Technology:

a) Interactive sales tools
Digital technology can help boost sales performance by enforcing a standardized and higher-
quality sales process to meet consumers‘ more sophisticated needs, and to help to level out
variations in the performance of salespeople. This module includes user-intuitive sales processes,
such as a fact finder and graphical financial-goal-management tool. These can be supported by
videos, product comparisons, and interactive fact displays to address frequently asked questions.

A financial-services player in Germany that implemented such a user-intuitive digital sales

approach saw substantial improvements: its number of satisfied customers increased by
300percent, while sales-force productivity increased by 40percent overall, as the gap between
top- and bottom-quartile performers narrowed. Another company saw more than 70percent of
customers awarding a maximum score on a feedback scoring metric for their satisfaction with a
new digital sales process and also saw a 25 percent increase in the average value of products
sold.

b) Digital fulfillment
Putting in place a digital process that minimizes manual data entry and the need for paper and is
highly automated (to facilitate straight-through processing as much as possible) can help to
ensure quick fulfillment. By speeding up the process, it can help to plug the leakages that can
occur between sale and closure. Using mobile phones enabled with point-of-sale capabilities, a
life-insurance player in Vietnam has made it possible for its agents to sign contracts with
customers in 24hours, a time frame that before the use of this technology was not possible.
Similarly, a life insurer in India has invested in making its sales process paperless and guarantees
a four-hour turnaround time to the customer for policy issuance.

Page 47
c) Performance management
To capture the value of all the modules of digital sales enablement, players should invest in a
performance-management system designed to monitor the activities related to the modules and
related digitally enabled activities. This system can help players enforce discipline in the sales
force, as well as keep track of the inputs and corresponding outputs and therefore tightly monitor
the sales funnel. Such a performance-management system can have varying levels of
sophistication, based on performance thresholds and deep analytics. These can range from basic
sales-funnel reports to triggers and alert escalations (for example, sending a short-message-
service alert to supervisors if a salesperson has delayed meeting a customer). Finance companies
have seen improvements in sales performance of as much as 20or 30percent within a year
following the implementation of this approach.

d) Capabilities and connectivity

Technology opens up a range of opportunities to carry out sales-force capability building, with
the added benefit that the instruments used can be made available on demand. Such opportunities
include the creation of relevant games, videos, e-lessons, and testing. When teaching best-
practice sales processes, successful companies often award a certificate to employees who do
well, which provides additional motivation. Likewise, putting in place a collaboration and
connectivity platform across the sales force can also help to build employee motivation and
opens up an opportunity for the sales force to share its successes and best practices.

e) Multichannel integration
As finance companies move to digital enablement of their sales operations, it is essential that
they carefully manage the integration between their traditional manual or physical routines and
the new digitally enabled ones. For example, the boundaries between the digital and physical
world are blurring as customers are increasingly researching online and then purchasing offline.
Financial-services players‘ sales and service processes must change to accommodate this trend.

One bank that responded to the change in sales landscape is an Indian bank, which created a
seamless multichannel account-opening process tailored to customers who like to take advantage
of both digital and physical tools and products. In the course of one day, a new customer can
interact with the bank across all of its channels—online, mobile, call center, and in-person
relationship manager—and open his or her account. The customer logs in basic details to apply
for the account online, confirms the transaction through a one-time password provided over his
or her mobile phone, receives a call from the call center within five minutes to confirm the
product purchase, and the next day, a bank sales person comes to the customer‘s office or
residence to collect the necessary documents and close the transaction. The bank is seeing a
significant uptick in sales since the launch of this process, especially in the metropolitan areas.

Page 48
11.2 Challenges in the way of digital sales enablement:

When undertaking a digital sales transformation, players frequently encounter a number of

common pitfalls.

Financial-services companies often define the transformation as a technology-led undertaking.

By doing this, they tend to set the project on the wrong course, because the program frequently
ends up focused on issues that are not aligned with the business‘s priorities, and it is not designed
with the ability to generate impact. Embarking on a technology-led course also often fails to win
the buy-in of the business side of the organization, which is ultimately responsible for driving the
transformation.

The technology mind-set can sometimes lead companies to take a ―big-bang approach‖ to digital
sales transformation, attempting to achieve transformation across all modules and implement all
technology interventions in one stroke. Such initiatives tend to run into delays and budget
overruns, which, in turn, extend the time it takes for the organization to see any real impact. In
the absence of evidence of any business value being captured, organizations then lose patience
with the transformation. Taking a big-bang approach also often sets a timeline that precludes
incorporating feedback from the field into the design of the solutions, which leads to problems at
the implementation stage.

In addition, many companies do not focus enough on capability building and on encouraging
mind-set and behavior shifts in the sales force. Any change in an organization‘s way of operating
tends to meet resistance in the sales force. It is therefore important for companies to focus on the
incentives and mandates supported by the change story in order to motivate the sales force to
adopt the new, digital way of selling products. Many companies still fail to do this.

Finally, companies often continue to maintain two ―ecosystems‖—a manual one alongside a new
digital one—that do not talk to each other. This leads to leakages on the ground. Financial
companies therefore need to ensure that the physical and digital worlds merge seamlessly and
that there are no break points. For example, companies must have a single system in place
through which management can view all sales irrespective of whether they are done physically or
using a digital device.

11.3 Ways of adopting digitization in Banking:

A systematic, holistic approach to a process redesign for the digital future allows Asian banks to
create a tailored mix of automation, lean transformation, centralization, or even outsourcing and
offshoring, to be applied to each process in a four-part program.

1. Zero-based process redesign. This approach allows banks to reinvent processes based on
world-class templates and lean archetypes for bank-process architecture. It can be driven
bottom-up or top-down, depending on the organizational appetite for technology
transformation.

Page 49
2. Lean-management best practices. Banks can apply well-established lean-management
processes in which management is retrained for performance management and continuous
improvement. Areas to focus on include day-to-day flexibility and removing waste and
rigidity, but the scope can be narrowed to emphasize core elements such as performance
management.
3. Rapid technology development. ―Agile scrum‖ development enables the creation of
technology building blocks in an intensive, iterative process. A work-cell team translates
concepts into hand-drawn outlines in hours. Within days, these become wireframe mock-ups
approved by business; a working prototype is then created and subjected to a daily cycle of
review, revision, and feedback.
4. Operating-model build-out. The build-out of the improvements is managed through a
dedicated center of excellence. The scope can be adjusted by process and by the extent of the
organization redesign; in an accelerated approach, the build-out can be preset within the
development cycle.
The approaches to rapid-process digitization can take two forms: balanced and accelerated. The
balanced approach is more comprehensive and methodical, requiring more organization-wide
buy-in, while the accelerated approach is more focused and intensive, making greater use of
disruptive technologies.
Agile delivery capabilities are of critical importance: this approach is smart by design and is not
intended to happen ―automatically.‖ Governance and performance-management tools are also
critical, as they are in any transformation: for transformative ways of working to stick,
performance has to be managed for the new norm at the outset, across all organizational silos.

11.4 Resulting State of Banking:

Rapid-process digitization is relevant to nearly half of a bank‘s cost base. It works process by
process and can lead to lower costs, higher productivity, faster delivery times, and reduced
customer leakage. As it proceeds, rapid-process digitization transforms the operating model—
processes are consolidated, functionalized, and outsourced or offshored as needed.

a) Channels, including branches, call centers, ATMs, and Internet: Channels are optimized
to enable efficient downstream processing, including electronic data capture in all branches
and programs implemented to encourage migration to digital channels.
b) Business (retail, commercial): Business is focused on product strategy, sales, and
distribution (for example, branches that are focused only on sales, with all fulfillment done in
operations).
c) Operations: Operational processes are managed end to end, with more than 600processes
defined and categorized into automated and partly automated; lean management is also
applied, with tailored metrics and management models.

Page 50
d) IT: All infrastructure functions are centralized, including operations, IT, finance, risk, human
resources, procurement, and fraud; processes are configured into cross-business utilities (for
example, payments and complaint management).
e) Other infrastructure, including human resources and finance: Offshore locations are
leveraged where relevant and work-flow tools dynamically allocate work across the footprint.
f) This approach creates the desired customer experience and substantially reduces customer-
value leakage. In mature markets, we have seen this approach improve productivity by 30to
90percent, measured in both cost and time to deliver, in almost half of a bank‘s total cost
base. In emerging markets, the impact can be even greater. The approach improves overall
risk management and management transparency by optimizing and clarifying the underlying
methods for each process. It also enables a more fundamental transformation of the operating
model, including consolidation, offshoring, or even outsourcing processes.

Page 51
12. Conclusion
Technology has facilitated this new approach to banking. Technology can now use the
intelligence and information that tele-net banking can provide through measuring the number of
hits on the web and the length of time of the hits etc. to continue to develop its products and
services. Technology knows that just as it has embraced technology, it is now a driver of change
within its market. The challenge it faces is to continue to develop its product proposition.
Technology must continue to deliver the right product, at the right time, to the right place, at the
right price if it is to remain the consumers champion.

Customers are gaining control of their banking relationships. Far-reaching changes in consumer
behaviors are driving banks to search for ways to bring new products and services to market
quickly. Financial institutions are beginning to acknowledge that they can‘t be responsive to
consumer demands because their legacy front-end payments systems are stuck in the Stone Age.
Building on these antiquated systems is simply too costly, too cumbersome and too risky. At the
same time, taking a tactical approach to each new product or service need will only work for so
long. It‘s like putting patches on a worn tyre eventually the structural aspects of the tyre will
collapse. For banks, the structural integrity of a payments system patched with all sorts of third
party features may hold for a year, or two, or five, but eventually it will need to be replaced in
order to keep business rolling smoothly. It‘s time now to take a total strategic approach to
refreshing the front-end payments infrastructure and leap ahead of the competition.

Page 52
Bibliography

 Report of the Technical Committee to Examine Uniform Routing Code & Account Number
Structure - Department of Payment and Settlement Systems, Central Office, Reserve Bank


of India.
Report and recommendation by Working Group on Securing Card Present Transactions -
Department of Payment and Settlement Systems, Central Office, Reserve Bank of India,


July 2014.
Report by Committee on Comprehensive Financial Services for Small Businesses


and Low Income Households.


Report of The Technical Committee on Mobile Banking - Reserve Bank of India
Report of the Group on Enabling PKI in Payment System Applications - Reserve


Bank of India, March 2014.
Report of the committee to study the feasibility of implementation of GIRO based
payment system in India – RBI, April 2013.
 Working Group Report on Cloud Computing Option for Small Size Urban
Cooperative Banks – RBI.
 Digital Banking in Asia - Winning approaches in a new generation of financial
services, Asia Financial Institutions, McKinsey & Company.Security in Online
Banking Services – A Comparative Study, ISSN: 2319-8753, IJIRSET, Vol. 3, Issue


10, October 2014.


www.rbi.org.in
http://www.ey.com/IN/en/Industries/Financial-Services/Banking---Capital-


Markets/EY-banking-on-technology-india-banking-industry
A Study On Innovations And Challenges In Banking Industries In India-
International Journal of Marketing, Financial Services & Management Research,
Vol.1 Issue 12, December 2012, ISSN 2277 3622.

Page 53