Lok Sabha Question No. 291 (STARRED), answered on 2017-03-22
Subject: Promotion of Digital Transactions
Ministry: ELECTRONICS AND INFORMATION TECHNOLOGY
Asked by: RAJEEV SHANKARRAO SATAV, VIJAYSINH MOHITE PATIL

## GOVERNMENT OF INDIA MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY

## LOK SABHA STARRED  QUESTION NO.  *291

TO BE ANSWERED ON:  22.03.2017

## PROMOTION  OF DIGITAL TRANSACTIONS

## *291    SHRI SATAV RAJEEV: SHRI MOHITE PATIL VIJAYSINH SHANKARARO:

Will the Minister of Electronics & Information Technology be pleased to state:

- (a) whether the Government is aware that the online payment system is not foolproof and open to potential attack by cyber thieves who can wipe out millions of rupees bypassing the weak firewalls and if so, the details thereof;
- (b) whether Government is planning to float rules for operation of e-wallets;
- (c) if so, the details thereof and the objective behind the move;
- (d) whether  the  Government  has  drafted  a  consultation  paper  in  this  regard  which  will  be shared  with  consumers  and  merchants  so  that  they  could  voice  their  worries  about  the new payment system; and
- (e) if so, the details thereof

## ANSWER

MINISTER FOR ELECTRONICS AND INFORMATION TECHNOLOGY (SHRI RAVI SHANKAR PRASAD)

- (a) to (e): A Statement is laid on the Table of the House.

## STATEMENT REFERED TO IN REPLY TO LOK SABHA   STARRED QUESTION *291 FOR 22.03.2017 REGARDING  PROMOTION OF DIGITAL TRANSACTIONS

……..

- (a): With the increase in digitization the cyber attacks are also growing worldwide.  Strengthening  of cyber  security  is  a  continuing  process.  It  is  the  primary  responsibility  of  agencies  involved  in  online payment to maintain adequate cyber security of their payment systems to avoid any mishap. Besides, Govt.  has  taken  several  steps  towards  enabling  a  secure  online  payment  systems.  Some  of  the  steps taken in this regards are as follows:
- (i) CERT-In issues  alerts  and  advisories  regarding  latest  cyber  threats/vulnerabilities  alongwith countermeasures  to  create  awareness  among  stakeholders  to  take  appropriate  measures  to ensure safe usage of digital technologies. Regarding securing digital payments, 21 advisories have been issued for users and institutions.
- (ii) In  addition,  all  authorised  entities/banks  issuing  Prepaid  Payment  Instruments  (PPIs)  in  the country  have  been  advised  by  Indian  Computer  Emergency  Response  Team  (CERT-In) through the Reserve Bank of India to carry out audit by the empanelled auditors of CERT-In on a priority basis and take immediate steps thereafter to comply with the findings of the audit report and ensure implementation of security best practices.
- (iii) All  organizations  providing  digital  payment  services  have  been  mandated  to  report  cyber security incidents to CERT-In expeditiously.
- (iv) Reserve Bank of India (RBI) carries out IT Examination of banks separately from the regular financial examination of banks from last year. This report has a special focus on cyber security. The reports have been issued to the banks for remedial action.
- (v) RBI has also set up Cyber Crisis Management Group to address any major incidents reported including suggesting ways to respond and recover to/ from the incidents.
- (vi) Department  of  Banking  Supervision  under  RBI  also  conducts  cyber  security  preparedness testing among banks on the basis of hypothetical scenarios with the help of CERT-In.
- (vii) RBI also has set up an IT subsidiary, which would focus, among other things, on cyber security within RBI as well as in regulated entities. The subsidiary is in the process of recruiting the experts.
- (viii) RBI has issued circular on 09th December 2016 in Security and Risk mitigation measure for all authorised entities / banks issuing Prepaid Payment Instrument (PPI) in the country.
- (ix) In addition, RBI issues Circulars/advisories to all Commercial Banks on phishing attacks and preventive / detective measures to tackle phishing attacks.
- (x) RBI has set up a Cyber Security and IT Examination (CSITE) cell within its Department of Banking Supervision in 2015.
- (xi) RBI has issued a comprehensive circular on Cyber Security Framework in Banks on June 2, 2016 covering best practices pertaining to various aspects of cyber security.

(b), (c), (d) and (e) :  Ministry of Electronics & Information Technology (MeitY) has formulated draft rules  on  Security  of  Prepaid  Payment  Instruments  under  Information  Technology  Act,  2000.  The objective of the proposed rules is to ensure adequate integrity, security and confidentiality of electronic payments effected through electronic prepaid payment instruments. The draft rules have been published on MeitY website inviting comments from public at large and all stakeholders.

MeitY has held a consultation meeting with PPI Issuers and related Industry Associations on 8 th March 2017 to brief them on the salient features of the proposed draft rules on Security of Prepaid Payment Instruments under the Information Technology Act 2000. All the stakeholders have been requested to provide comments on the draft rules

Further,  the  Reserve  Bank  of  India  is  undertaking  a  comprehensive  review  of  the  Prepaid  Payment Instrument guidelines which also addresses the requirements for safety and security, customer service and  protection  aspects,  risk  mitigation  measures,  complaint  redressal  mechanism  etc.  The  revised guidelines will be issued shortly by RBI.

********