You Can Say NO to OTP for Small Transactions, but You Should NOT

You can now opt out of OTP for transactions less than Rs 2000. Representational Image. (Photo: iStock)

Sick of OTPs? RBI has a new notification. You can say NO to the One Time Passwords that you need to key in every time you do an online transaction, but only for transactions less than Rs 2,000.

The idea is that the OTP is a pain. You get it by SMS. And SMS is not “deterministic” in the sense that there’s no guarantee you’ll actually get it. And then your phone’s battery may be off (and you might be trying to buy a new battery online!). Or you may be in a remote location with no mobile coverage, but some internet. And if you don’t get the SMS, you can’t finish your transaction. Plus, it’s a bit of a pain to wait for it.

Also Read: Why Going Cashless Is Going to Be Tough in India

So the RBI says:

• We’ll allow YOU (the cardholder) to say “I don’t want OTP, dammit”
• But only for transactions that cost less than Rs 2,000
• And then also, it’s not smooth
• Because your card network – the Mastercard/Visa/Rupay – will ask you to login with a username and password you create on their website. Then only does the payment go through.
• So they’re replaced an OTP with a password, even if you did opt out

This is not so much of a difference. So instead of entering your card details and then an OTP, you just enter a login/password for each transaction at the mastercard/visa layer. To counter, banks could offer you the ability to use a password instead of an OTP. (HDFC Bank does offer it, and I really thank them for it)

Also Read: Govt Declares Rs 10 Incentive For Shifting to Cashless Transaction

Banks could now offer you the ability to use a password instead of an OTP. Representational Image. (Photo: iStock)

So if your card details (minus CVV) are stored at say Flipkart or Amazon, your choices are:

• Checkout with CVV (since other card details are stored), and then OTP/Password at bank
• Or, in the new system, check out and enter Mastercard/Visa login and password if the transaction size is less than Rs 2,000

For a consumer, the amount of work is approximately the same.

The OTP is not sacrosanct – a bank can offer ANYTHING as a second factor of authentication. They can ask you a password, a secret question, or even a fingerprint. But many banks just default to using OTPs, which are a pain.

Also Read: Do You Think Your Bank ATM Cards Are Secure? Think Again!

But now, a user has to opt out of the 2FA plan for less than Rs 2,000 transactions. Then he has to create a user id and password at the network site (like a Visa checkout or such).

Then a website/online merchant has to support non-2FA authentication, and when you check out, you need to go to that site, login again and approve the transaction. Instead of keying in your card number and CVV etc, you key in the username and password.

This may not really be of big use to anyone, since the number of steps involved are similar. However, it allows you to not put your card details in a merchant website, which is a nice security measure at a new website. (However, if you don’t opt out, you can give your card details to anyone – they won’t be able to use it without an OTP/Password. You can disable international transactions – they are disabled by default)

Also Read: Debit Card Security Breach: How to Stay Safe Online

We Say: Don't Give up the OTP!

Imagine that a card database leaks out and after some attempts, a bot is able to charge your account with, say, Rs 200 at a time. You will now have to fight to get it reversed, and probably file an FIR with the cops etc. This is a horrendously difficult task in India and you will waste too many days on it.

Plus, you’re going to need an OTP for transactions greater than Rs 2,000 anyway.

And this won’t make your Uber ride any easier. You can’t enter your card details and have them charge whatever they want – the card network login will be needed for each payment (and Uber won’t be allowed to store those details).

It’s just useless then to have:

• Card network login id and password if less than Rs 2,000
• OTP if greater than Rs 2,000

Just keep the darn OTP.

Also Read: Credit Cards May Not Help You Either As Demonetisation Takes Toll

It’s safer too; if you don’t have the card network login, you would be hit if people started taking out small amounts from your account on a regular basis.

That will happen if your card is compromised – even a waiter noting down card details will be able to use it later at his house. (With an OTP, or with a card network login, he will need information not on the card. So it’s tougher).

If you want to keep getting the OTP, don’t do anything.

If you still want to opt out of this OTP thing, then you have to wait till your card issuer enables the option to opt-out, and then manually create a user name and password at the VISA/MC/RUPAY sites (which don’t have the facility right now). Only then does the OTP stop for small translation.

But our view is that OTP is easier. So don’t opt-out.

Also Read: Cashless Already? Thank Ethical Hackers for Protecting Your Money

(This article was originally published in Capitalmind. Deepak Shenoy is the CEO at Capitalmind, where he creates investment strategies and analyses macro-economics with his team in Bangalore. He loves the weather and hates the traffic.)

Also Read: Your Paytm Wallet Money Is Not Safe