I85PREP
⌘ K
IIBF Digital Banking study materials
IIBF Digital Banking study resources

IIBF Digital Banking practice questions

One question at a time. Build your IIBF Digital Banking understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Digital Banking

Under the RBI's guidelines on digital lending, a loan disbursed by a regulated entity must be credited directly to which account?

  1. The borrower's bank account Correct answer.
  2. The lender's nodal account
  3. The LSP's escrow account
  4. The borrower's digital wallet

Explanation

Digital lending rules require direct disbursal into the borrower's bank account so that funds pass through the regulated entity's books and cannot be routed or netted by a lending service provider. Crediting a wallet or an intermediary account breaks this flow-of-funds requirement.

Question 2Digital Banking

In UPI terminology, what does a 'mandate' primarily enable a payer to do?

  1. Convert a wallet balance into a bank deposit
  2. Authorise recurring or one-time debit without entering a PIN each time Correct answer.
  3. Link a new mobile number to an existing account
  4. Dispute a failed transaction and claim compensation

Explanation

A UPI mandate is an authorisation given by the payer permitting an approved payee to debit the account up to a stated amount and frequency, often without a fresh PIN for each collection. It is the mechanism behind auto-debit and subscription payments.

Question 3Digital Banking

A bank wants customers to complete KYC for a savings account entirely through a mobile app using Aadhaar-based OTP verification. Which process is being described?

  1. Aadhaar e-KYC Correct answer.
  2. In-person verification by a banking correspondent
  3. Physical paper KYC with attestation
  4. Video-based customer identification process

Explanation

Aadhaar e-KYC uses OTP authentication against the Aadhaar database to verify identity and address electronically, with the customer's consent. It is distinct from video-based identification, which requires a live interaction with an official.

Question 4Digital Banking

Which security control most directly protects card data at a merchant so that the merchant never stores the full primary account number?

  1. Tokenisation of the card Correct answer.
  2. Transaction velocity limits
  3. Two-factor authentication at login
  4. Merchant chargeback insurance

Explanation

Card tokenisation replaces the primary account number with a surrogate token that is meaningless outside the authorised ecosystem, so a merchant breach does not expose usable card credentials. Authentication, velocity limits and insurance address other risks and do not remove stored PAN data.

Question 5Digital Banking

A customer's UPI payment fails but the amount is debited from the account. Under the RBI's harmonised turn-around-time framework, what is the regulated entity required to do if the auto-reversal does not occur within the prescribed TAT?

  1. Charge the customer a re-processing fee
  2. Close the complaint without further action
  3. Convert the debit into a fixed deposit
  4. Pay the customer compensation of one hundred rupees per day of delay Correct answer.

Explanation

The harmonised TAT framework requires auto-reversal of failed transactions and, where the reversal is delayed beyond the prescribed timeline, payment of a penalty of one hundred rupees per day of delay to the customer. This creates a financial incentive for timely resolution.

Question 6Digital Banking

A fintech firm wants to offer instant paperless sanction of small personal loans by pulling a borrower's credit information. Which entity must it typically partner with to access that credit bureau data lawfully?

  1. A merchant acquirer
  2. A payment aggregator
  3. A regulated entity such as a bank or NBFC Correct answer.
  4. A co-operative credit society

Explanation

Access to credit information and the ability to lend are anchored in a regulated entity, so a fintech typically acts as a lending service provider to a bank or NBFC. A payment aggregator or acquirer handles payments, not credit underwriting.

Question 7Digital Banking

In the context of digital payments, what is 'interoperability'?

  1. The requirement to store all transaction data in one data centre
  2. The ability of a customer to transact across different payment systems and providers using one instrument Correct answer.
  3. The process of merging two payment companies
  4. The ability of a bank to set its own interchange fee

Explanation

Interoperability means a payment instrument or identifier issued by one provider can be used across other systems and acceptance points, for example a wallet or UPI identifier working at any participating merchant. It is a core design principle of retail digital payments.

Question 8Digital Banking

Which characteristic best distinguishes a 'neobank' from a traditional licensed bank in the Indian context?

  1. It typically operates as a front-end technology layer partnering with a licensed bank rather than holding a banking licence itself Correct answer.
  2. It is barred from offering any payment services
  3. It can issue its own legal tender currency
  4. It is exempt from all KYC requirements

Explanation

Neobanks in India generally provide the digital customer interface and experience while the underlying deposit and lending products sit with a licensed bank partner. They do not hold a universal banking licence and remain subject to KYC through that partner.

Question 9Digital Banking

A bank's mobile app uses the device's fingerprint sensor to authenticate a customer before a fund transfer. What is this an example of?

  1. Something the user knows
  2. Something the user has
  3. Something the user does at a branch
  4. Something the user is, used as an authentication factor Correct answer.

Explanation

Biometric authentication such as a fingerprint verifies an inherent physical characteristic, which is the 'something you are' factor. It is commonly combined with a PIN or device binding to achieve multi-factor authentication.

Question 10Digital Banking

What is the primary purpose of a virtual payment address in UPI?

  1. To set the interchange rate for the transaction
  2. To encrypt the transaction message end to end
  3. To record the merchant's GST number
  4. To act as a payer identifier that masks the actual bank account details Correct answer.

Explanation

A virtual payment address is a handle such as name@bank that maps to an underlying account, allowing payments without sharing account numbers or IFSC codes. It improves privacy and simplifies the payer experience.

Question 11Digital Banking

A bank wants to allow customers to open a fixed deposit instantly on its website without visiting a branch, using their existing account data. Which capability is essential for this?

  1. A printed passbook issued at the branch
  2. Real-time API integration between the bank's channels and its core banking system Correct answer.
  3. A physical signature on a paper form
  4. A separate credit card application

Explanation

Instant digital fulfilment requires the customer-facing channel to call the core banking system in real time through APIs so that the deposit is booked immediately. Without such integration, the request would need manual processing.

Question 12Digital Banking

A customer receives an SMS saying their electricity connection will be disconnected unless they install an app that will 'update their KYC' and asks them to share an OTP. What type of fraud is this?

  1. Vishing combined with OTP phishing Correct answer.
  2. Cross-site scripting on a website
  3. Insider data theft by a bank employee
  4. Card skimming at an ATM

Explanation

The fraud uses a telephone or SMS pretext to create urgency and then harvests an OTP, which is a classic social-engineering attack combining voice/SMS deception with OTP phishing. No card device or website vulnerability is involved.

Question 13Digital Banking

In the context of digital banking security, what does 'device binding' achieve?

  1. It increases the maximum transaction limit automatically
  2. It transfers ownership of the device to the bank
  3. It guarantees the device has the latest antivirus software
  4. It ties a customer's credentials to a specific registered device so logins from unknown devices are restricted Correct answer.

Explanation

Device binding associates the customer's authentication credentials with a unique device identifier so that a stolen password alone cannot be used from an unrecognised device. It is a risk-mitigation control, not a guarantee of device hygiene or a change in transaction limits.

Question 14Digital Banking

A payment aggregator handling e-commerce transactions is required to ensure that funds collected from customers are held in which manner before settlement to merchants?

  1. In the merchant's personal savings account
  2. In the aggregator's own working capital account
  3. In a fixed deposit pledged to the aggregator's parent company
  4. In an escrow account with a scheduled commercial bank Correct answer.

Explanation

Payment aggregators must keep customer funds in an escrow account with a scheduled commercial bank so that merchant settlements are protected from the aggregator's own operational or insolvency risk. Commingling with the aggregator's own funds is not permitted.

Question 15Digital Banking

A bank's digital channel records a customer's consent before sharing account data with a third-party financial app. Which framework governs such consent-based data sharing in India?

  1. The Negotiable Instruments Act
  2. The Coinage Act
  3. The SARFAESI Act
  4. The Account Aggregator framework Correct answer.

Explanation

The Account Aggregator framework enables consent-based, purpose-limited sharing of financial data between regulated entities through data-blind aggregators. The other statutes deal with instruments, enforcement of security and currency, not data sharing.

Question 16Digital Banking

Which of the following best describes the role of a 'consent artefact' in the Account Aggregator ecosystem?

  1. A physical signature on a loan agreement
  2. A token used to log in to internet banking
  3. A machine-readable record of the purpose, duration and data types the customer has approved Correct answer.
  4. A certificate issued by the bank's auditor

Explanation

A consent artefact digitally captures the scope of consent, including purpose, data life, frequency and the data types the customer has authorised. It allows the aggregator and data providers to enforce the consent precisely.

Question 17Digital Banking

A bank wants to reduce the risk of man-in-the-middle attacks on its mobile banking app. Which measure addresses this most directly?

  1. Certificate pinning within the app Correct answer.
  2. Sending promotional SMS to customers
  3. Increasing the daily transaction limit
  4. Allowing logins from any browser

Explanation

Certificate pinning makes the app accept only a specific known server certificate, defeating interception through a fraudulent proxy or rogue certificate authority. Raising limits or allowing unrestricted browsers increases exposure rather than reducing it.

Question 18Digital Banking

What is the main purpose of a real-time gross settlement system in the context of digital banking?

  1. To batch small retail payments at the end of the day
  2. To store KYC records of customers
  3. To settle high-value interbank payments individually and immediately Correct answer.
  4. To provide customer loyalty points

Explanation

An RTGS system processes and settles each high-value payment instruction individually in real time, providing finality. Retail batch clearing is handled by separate deferred net settlement systems.

Question 19Digital Banking

A customer uses a prepaid payment instrument issued by a non-bank entity. Which statement about such an instrument is correct?

  1. It can be issued without any KYC for any amount
  2. It can be used to withdraw cash at any ATM
  3. It can be loaded only from a bank account or another eligible source and is redeemable at merchants, not for cash withdrawal Correct answer.
  4. It earns interest at the savings bank rate

Explanation

Non-bank prepaid instruments are payment instruments funded from eligible sources and used for purchases; they are not cash-withdrawal or interest-bearing deposit products. KYC and balance limits apply depending on the type of instrument.

Question 20Digital Banking

Which of these is the most appropriate first response by a bank when it detects anomalous transactions on a customer's digital channel consistent with account takeover?

  1. Publish the customer's details on the bank's website
  2. Ignore it until the customer complains
  3. Temporarily block the channel and contact the customer through a pre-registered contact point Correct answer.
  4. Increase the transaction limit to test the channel

Explanation

Containing the incident by blocking the compromised channel and verifying with the customer through pre-registered contact details limits further loss. Public disclosure or raising limits would worsen exposure.

Question 21Digital Banking

What does 'data localisation' require of payment system operators under RBI rules?

  1. Data must be deleted every twenty-four hours
  2. Payment system data must be stored only in India Correct answer.
  3. Only encrypted data may be sent abroad for processing with no local copy
  4. All customer data must be stored abroad

Explanation

RBI requires that the entire payment system data be stored in India, with limited provision for processing abroad if the data is brought back within the stipulated time. It does not mandate deletion or prohibit local retention.

Question 22Digital Banking

A bank offers a 'video KYC' onboarding journey. Which element is essential to make it compliant?

  1. A scanned copy of a utility bill only
  2. A live, recorded interaction with an official who verifies the customer and documents Correct answer.
  3. A self-declaration by the customer without any verification
  4. An automated chatbot with no human involvement

Explanation

VBCIP requires a real-time, recorded interaction between the customer and a bank official, along with verification of the original documents and liveness checks. A chatbot or self-declaration alone does not satisfy the requirement.

Question 23Digital Banking

In the context of digital lending apps, what is the significance of the 'Key Facts Statement'?

  1. It is the lender's internal audit report
  2. It discloses the annualised cost, fees and terms so the borrower can compare offers Correct answer.
  3. It is a marketing brochure with no regulatory standing
  4. It is the app's privacy policy

Explanation

A Key Facts Statement standardises disclosure of the all-inclusive annualised rate, fees and repayment terms, enabling informed comparison by the borrower. It is a regulatory disclosure, not marketing material.

Question 24Digital Banking

Which of the following is a key feature of the Bharat Bill Payment System?

  1. An interoperable platform for recurring bill payments across multiple billers and channels Correct answer.
  2. A scheme for insuring bank deposits
  3. A system exclusively for interbank high-value transfers
  4. A platform for issuing credit cards

Explanation

BBPS provides an interoperable, standardised network through which customers can pay bills of many billers using various channels and payment modes. It is not a high-value transfer system or a card-issuing scheme.

Question 25Digital Banking

A customer wants to make a contactless card payment of a small amount without entering a PIN. What is the usual safeguard applied to such transactions?

  1. Mandatory OTP for every tap
  2. A requirement to sign a charge slip for every tap
  3. A per-transaction cap with periodic PIN verification after a cumulative limit Correct answer.
  4. No cap at all, since contactless is always PIN-free

Explanation

Contactless transactions are permitted without a PIN up to a per-transaction limit, and after a cumulative value or count the customer must authenticate with a PIN. This balances convenience with fraud control.

Question 26Digital Banking

Under RBI's Digital Lending Guidelines, a regulated entity disbursing a loan through a digital lending app must ensure that disbursal and repayment flows are routed directly between the borrower's bank account and which other account?

  1. The payment aggregator's nodal account maintained for merchant settlements
  2. The borrower's wallet issued by the app's parent company
  3. The lending service provider's escrow account held with a scheduled commercial bank
  4. The regulated entity's own bank account, with no pass-through of any third party Correct answer.

Explanation

RBI requires direct disbursal into and repayment from the borrower's bank account, with no pass-through of any third-party pool account such as an LSP's account. Routing funds through the LSP or a wallet breaks the audit trail and is prohibited. The regulated entity remains accountable for the entire flow.

Question 27Digital Banking

A bank's internet banking portal displays a message that a customer's session will expire after a fixed period of inactivity and requires re-authentication. Which control objective does this primarily serve?

  1. Reducing the bank's liability for card chargebacks
  2. Increasing the throughput of concurrent user logins
  3. Limiting exposure to session hijacking on unattended devices Correct answer.
  4. Meeting the minimum balance disclosure requirement

Explanation

Idle-session timeouts cut the window in which an abandoned or hijacked session can be misused by someone else at the terminal. They are a standard application-level security control in internet banking. Throughput, chargeback liability, and balance disclosure are unrelated to session expiry.

Question 28Digital Banking

A customer links a credit card to a UPI application and pays a merchant by scanning a QR code. Which statement correctly describes the authorisation of this transaction?

  1. The transaction settles only after the customer signs a physical charge slip
  2. The customer authenticates with a UPI PIN, and the card issuer debits the card account on the UPI rails Correct answer.
  3. The merchant's bank authorises the payment without any customer credential
  4. The card network blocks all UPI-linked card payments by design

Explanation

RuPay credit cards on UPI are enabled through a UPI PIN, and the transaction rides the UPI switching and settlement infrastructure while debiting the linked card account. No physical slip or merchant-side authorisation substitutes for the customer's PIN. Card networks participate by permitting their cards to be linked.

Question 29Digital Banking

Which entity operates the centralised electronic registry that records consent for financial information sharing under India's Account Aggregator framework?

  1. The Reserve Bank of India's core banking division
  2. The Account Aggregator, which is an RBI-licensed NBFC Correct answer.
  3. The Securities and Exchange Board of India
  4. The National Payments Corporation of India

Explanation

An Account Aggregator is a licensed NBFC that manages consent artefacts and acts as the consent manager between financial information providers and users. It does not itself hold or use the data. Its licence and data-blind role are central to the framework.

Question 30Digital Banking

In a bank's mobile banking app, the server issues a short-lived token after login that the app presents with each API call instead of resending the password. What is the main security benefit of this design?

  1. The token encrypts the customer's device storage automatically
  2. The token permanently replaces the need for any user authentication
  3. The token guarantees that the API call originates from a registered merchant
  4. The password is not repeatedly transmitted, and the token can be revoked or expired independently Correct answer.

Explanation

Token-based sessions avoid repeated transmission of the static secret and allow the bank to expire or revoke access without changing the password. They supplement, rather than replace, authentication. Device storage encryption and merchant identity are separate concerns.

Question 31Digital Banking

A customer's UPI transaction fails but the amount is debited from the account. Under the RBI's harmonised turn-around-time rules for failed transactions, what is the bank's obligation if the auto-reversal does not occur within the prescribed timeline?

  1. Refer the customer to the merchant's bank for a refund
  2. Pay compensation per the prescribed per-day rate for the delay, without the customer having to file a complaint Correct answer.
  3. Retain the amount as a float until the customer visits a branch
  4. Adjust the amount against the customer's next loan instalment

Explanation

RBI's TAT framework requires auto-reversal of failed transactions within the specified timeline and imposes a per-day compensation payable to the customer for delays beyond it. The burden falls on the bank, not the customer. The customer is not required to chase the merchant's bank for a failed UPI debit.

Question 32Digital Banking

A bank wants its customers to make small-value merchant payments at physical stores by tapping a phone that emulates a card. Which technology standard enables this?

  1. Magnetic ink character recognition printed on the receipt
  2. Host card emulation of card credentials on the mobile device Correct answer.
  3. A static QR code printed at the point of sale
  4. Unstructured supplementary service data over the telecom network

Explanation

Host card emulation lets a phone store tokenised card credentials in a secure element or trusted execution environment and present them to a contactless terminal as if it were a card. It enables tap-to-pay without a physical plastic card. The other options describe unrelated or non-contactless mechanisms.

Question 33Digital Banking

Which statement about the Prepaid Payment Instrument issued by a bank and the wallet issued by a non-bank entity is accurate under RBI rules?

  1. Only the non-bank wallet is a PPI; the bank-issued instrument is treated as a debit card
  2. Neither can be used for merchant payments
  3. Both permit unlimited cash withdrawal at any ATM by default
  4. Both are PPIs, but only the bank-issued one may be made reloadable with cash withdrawal permitted in eligible cases Correct answer.

Explanation

RBI treats both bank-issued and non-bank-issued prepaid instruments as PPIs, with differentiated permissions such as cash withdrawal being available only to certain bank-issued full-KYC PPIs. Non-bank wallets cannot offer cash withdrawal. Both categories can be used for merchant payments within limits.

Question 34Digital Banking

A customer notices an unauthorised debit on a card and reports it to the issuer within three working days. Under RBI's limited liability framework for unauthorised electronic transactions, what is the customer's liability?

  1. A fixed penalty equal to the annual card fee
  2. Fifty percent of the disputed amount in all cases
  3. Zero liability, provided the fraud is not due to the customer's own negligence Correct answer.
  4. The full disputed amount until the investigation closes

Explanation

RBI's customer protection framework gives zero liability where the unauthorised transaction is reported within three working days and the customer has not been negligent. Liability scales up only with delayed reporting. Fixed penalties and blanket fifty-percent sharing are not part of the framework.

Question 35Digital Banking

Which of the following is a defining feature of a Payment Aggregator's operations that distinguishes it from a Payment Gateway?

  1. The aggregator issues credit cards to merchants
  2. The aggregator holds and settles funds with merchants, while a pure gateway only provides the technical processing interface Correct answer.
  3. The aggregator is barred from onboarding merchants
  4. The gateway must obtain an authorisation from RBI to settle merchant funds

Explanation

A payment aggregator handles funds in a nodal or escrow arrangement and settles with merchants, whereas a pure payment gateway provides only the technology layer and does not touch funds. This distinction drives the authorisation requirements. Issuing credit cards and barring merchant onboarding are not features of aggregation.

Question 36Digital Banking

A bank deploys a system that scores each online transaction in real time against behavioural and device signals and holds suspicious ones for step-up authentication. What is this capability called?

  1. Batch reconciliation of end-of-day ledgers
  2. Cheque truncation processing
  3. Static password policy enforcement
  4. Real-time fraud risk scoring with adaptive authentication Correct answer.

Explanation

Real-time risk scoring evaluates transaction context and triggers adaptive authentication when risk is elevated, letting low-risk payments proceed smoothly. It is distinct from end-of-day reconciliation and static policy enforcement. Cheque truncation is a separate clearing process.

Question 37Digital Banking

Which of the following best describes the role of a token in card-on-file tokenisation?

  1. The token is the card issuer's bank identification number
  2. A surrogate value replaces the card number, so merchants store the token instead of the actual card details Correct answer.
  3. The token is the CVV printed on the back of the card
  4. The token is a one-time password sent to the cardholder's phone

Explanation

Card-on-file tokenisation substitutes a unique surrogate for the primary account number, so a merchant can process repeat payments without storing the real card data. The token is bound to the merchant and device context. It is not an OTP, the CVV, or the BIN.

Question 38Digital Banking

A bank's regulator requires that payment system data be stored only in India, with a copy permitted abroad only if the regulator can access it. Which practice satisfies this requirement?

  1. Encrypting data abroad so that local storage becomes unnecessary
  2. Storing all payment data exclusively in a foreign cloud region
  3. Storing only the audit logs in India while the transaction data remains abroad
  4. Storing the full payment data set in India and ensuring foreign copies are retrievable by the regulator Correct answer.

Explanation

Data localisation for payment systems mandates that the complete payment data be held in India, with foreign processing or copies permitted only where the regulator can access them without delay. Encryption abroad does not satisfy localisation. Audit logs alone are insufficient.

Question 39Digital Banking

A customer opens a savings account through a fully digital journey using Aadhaar-based e-KYC. Which element is essential for the e-KYC to be valid?

  1. Explicit customer consent for authentication of Aadhaar and retrieval of demographic details from UIDAI Correct answer.
  2. A branch manager's manual approval of every application
  3. A physical signature on a printed account opening form
  4. Submission of a self-attested electricity bill as proof of address

Explanation

Aadhaar-based e-KYC is valid only with the customer's explicit consent for authentication and for receiving demographic data from UIDAI. The process is paperless, so physical signatures and manual branch approvals are not essential elements. Address proof is obtained through the e-KYC data rather than separate documents.

Question 40Digital Banking

Which statement correctly describes the Bharat Bill Payment System's operating structure?

  1. It requires customers to visit a biller's office to register each payment
  2. It is an interoperable network where billers are onboarded through aggregators and customers pay via multiple channels Correct answer.
  3. It settles only credit card bills and no utility bills
  4. It is a closed system usable only through a single bank's mobile app

Explanation

BBPS is an interoperable bill payment network in which billers are onboarded via Bharat Bill Payment Operating Units and customers can pay through many channels including apps, agents, and internet banking. It covers a wide range of billers, not credit card bills alone. It is designed for remote payment, not office visits.

Question 41Digital Banking

A bank wants to detect whether a customer's online banking credentials have appeared in a third-party data breach and force a password reset. Which practice does this represent?

  1. Disabling two-factor authentication to simplify logins
  2. Increasing the minimum password length for new users only
  3. Moving the login page to a different web address
  4. Credential compromise monitoring with proactive reset enforcement Correct answer.

Explanation

Monitoring for leaked credentials and forcing a reset protects accounts whose secrets may already be in criminal hands. It is a reactive-but-proactive control distinct from changing password policy for new users. Weakening authentication or changing the URL does not address compromised secrets.

Question 42Digital Banking

In digital banking, what does the term 'straight-through processing' most accurately describe?

  1. Processing only transactions initiated at an ATM
  2. Clearing transactions in a single daily batch
  3. Handling a transaction end to end electronically without manual intervention Correct answer.
  4. Routing every transaction through a branch officer for approval

Explanation

Straight-through processing means the transaction is validated, authorised, and settled electronically across systems without human touch, which improves speed and reduces errors. It is the opposite of manual routing. It is not limited to ATMs or to batch clearing.

Question 43Digital Banking

A bank offers an API that lets a third-party tax platform fetch a customer's account statement. Which control is most important before the data is released?

  1. Confirmation that the third party has a large customer base
  2. Assurance that the third party uses the same core banking software
  3. Verification that the request is made outside business hours
  4. Verification of the customer's explicit consent and the scope and duration of the data request Correct answer.

Explanation

Open banking data sharing rests on scoped, time-bound customer consent, and the bank must verify that consent and the requested data fields before release. The third party's size or software stack is irrelevant to the authorisation decision. Timing of the request does not establish legitimacy.

Question 44Digital Banking

A bank plans to let customers withdraw cash from an ATM using a UPI app instead of a card. Which mechanism makes this possible?

  1. The ATM reads the customer's fingerprint stored on the card
  2. The ATM dispenses cash and debits the account the next day without authentication
  3. The ATM generates a dynamic QR or a UPI request that the customer approves in the app, and the ATM dispenses cash after confirmation Correct answer.
  4. The customer emails a request to the branch, which pre-authorises the ATM

Explanation

Cardless cash withdrawal via UPI works by presenting a QR or UPI collect request at the ATM and dispensing cash only after the customer approves it with a UPI PIN in the app. Authentication happens in the app, not through a card or stored fingerprint. Dispensing without authentication would be a severe control failure.

Question 45Digital Banking

A bank's digital channel must ensure that a message cannot be altered in transit between the customer's app and the server, and that the server's identity is verified. Which combination achieves this?

  1. Base64 encoding of the payload for integrity
  2. Compression of the request body for authenticity
  3. TLS with certificate validation for confidentiality and integrity Correct answer.
  4. A longer customer password for server authentication

Explanation

TLS provides encryption and integrity protection, and certificate validation lets the client verify the server's identity, blocking man-in-the-middle attacks. Encoding, password length, and compression do not authenticate the server or protect message integrity.

Question 46Digital Banking

Which statement about the National Automated Clearing House in digital banking is accurate?

  1. It is a securities depository for dematerialised shares
  2. It is a bulk electronic clearing system used for high-volume, low-value credit and debit transactions such as salaries and utility payments Correct answer.
  3. It is a real-time gross settlement system for large interbank transfers
  4. It is a card network that authorises point-of-sale transactions

Explanation

NACH handles bulk, repetitive, low-value credits and debits such as salary payments, dividends, and utility collections. Large-value real-time settlement is handled by RTGS, and card authorisation and securities depository functions belong to entirely different systems.

Question 47Digital Banking

A customer receives a request in a UPI app to approve a 'collect' from an unknown person claiming to send money. What is the correct interpretation of the request?

  1. Approving it credits the customer's account with the requested amount
  2. Approving it cancels the request without any financial effect
  3. Approving it authorises a debit from the customer's account to the requester Correct answer.
  4. Approving it only verifies the customer's identity to the requester

Explanation

A UPI collect request is a demand for payment, and approving it with the PIN debits the customer's account in favour of the requester. It does not bring money in. This is the basis of the common 'request money' fraud, so unknown collects should be declined.

Question 48Digital Banking

Which of the following is the standard purpose of a 'cooling period' imposed on a newly registered beneficiary for large-value digital transfers?

  1. To delay the first transfer so that a fraudulent addition can be detected and reversed before funds leave Correct answer.
  2. To verify the beneficiary's credit score before payment
  3. To convert the transfer into a cheque-based payment
  4. To earn interest for the bank on the customer's balance

Explanation

A cooling period limits how soon after registration a large transfer can be made, giving the bank and customer time to spot a fraudulent beneficiary addition, often the result of account takeover. It is a fraud control, not a revenue or credit-scoring measure. It does not change the payment instrument.

Question 49Digital Banking

A bank's chatbot assists customers with balance enquiries and fund transfers. Which control is most critical before the chatbot executes a fund transfer?

  1. Logging the chat transcript for quality review
  2. Limiting the chatbot to English-language conversations
  3. Displaying a disclaimer that the chatbot is automated
  4. Re-authentication of the customer with a transaction credential independent of the chat session Correct answer.

Explanation

Conversational channels can be spoofed or hijacked, so a payment instruction must be bound to a strong transaction credential such as a UPI PIN or OTP outside the chat session. Disclaimers and logging are useful but do not authorise a payment. Language restriction is an operational choice, not a security control.

Question 50Digital Banking

Which statement best explains why digital banks rely on video-based customer identification while also storing the recording?

  1. The video call is used to collect the customer's initial deposit in cash
  2. The recording replaces the need for any identity document
  3. The live interaction verifies the person against documents, and the recording provides an auditable trail for the regulator and disputes Correct answer.
  4. The recording is required only for customers above sixty years of age

Explanation

Video KYC combines liveness and document verification during a live interaction, and the recording creates evidence that the process was followed. It does not replace identity documents. Deposits are not collected in cash over a video call, and the requirement is not age-specific.