Digital Banking
Digital Banking tests controls over ATMs, cards, internet and mobile banking, UPI and payment rails. Expect questions on additional factor authentication, tokenisation, transaction limits, cooling periods and RBI's customer liability rules for unauthorised electronic transactions.
Core rules
- AFA: card-not-present and mobile banking transactions need a dynamic second factor; OTPs must be random, time-bound and never static.
- Tokenisation: since 1 October 2022 merchants cannot store actual card data; a token replaces the PAN, reducing breach exposure.
- Customer liability (RBI 2017): zero liability for a third-party breach if reported within three working days; limited liability if reported within four to seven working days; beyond that, liability follows the bank's policy.
- Channel controls: TLS and certificate pinning, device binding, SIM-swap detection, velocity checks, beneficiary cooling periods and risk scoring.
- Limits: NPCI and bank-set limits apply per transaction and per day for UPI, IMPS and cards.
Worked example
A customer reports an unauthorised UPI payment of ₹20,000 on day five. This is a third-party breach reported after three but within seven working days, so the customer bears capped limited liability, ₹5,000 for that transaction band, not the full amount. The bank must credit the disputed amount within the prescribed timeline, investigate device and SIM logs, and may reverse after review.
Traps
Treating a token as encrypted card data, when it is a surrogate; missing SIM-swap fraud; ignoring the three-day and seven-day thresholds; assuming zero liability applies when the customer shared the OTP, which is gross negligence.