Digital Banking and Technology
Digital Banking and Technology tests payment rails, digital channels, outsourcing, customer protection and cyber-risk controls. Questions often turn on channel limits, authentication and who bears loss after fraud.
Rails and controls
- NEFT operates 24x7 with no minimum; RTGS is for high-value transfers with a ₹2 lakh minimum and no upper cap; IMPS and UPI are real-time retail rails.
- UPI is operated by NPCI, not by an individual bank; a bank can be a UPI payer or payee PSP.
- Card-not-present transactions need additional authentication; card tokenization replaces the card number with a token.
- RBI’s digital lending guidelines require direct disbursal to the borrower’s bank account, disclosure of the lending service provider, a cooling-off period and no automatic increase in credit limit.
- The account aggregator framework works only with explicit, revocable customer consent.
Worked example
A customer clicks a phishing link, shares an OTP and suffers an unauthorised UPI debit of ₹20,000. Because the customer shared the OTP, this is customer negligence rather than a pure bank-system breach. The bank is not automatically liable for the loss before the customer reports it, but the customer should notify the bank immediately; after notification, the bank must block further debits and investigate. The outcome differs from a skimming case where the customer kept credentials secret.
Traps
Do not say RTGS has no minimum; do not call UPI a bank-owned system; do not assume digital lending permits cash disbursal; and do not treat OTP sharing as zero customer liability.