Stolen fingerprints, empty bank accounts: How customers are paying for gaps in Aadhaar
In May, YouTuber Singh’s social media thread went viral. It detailed how money was allegedly siphoned out of his mother’s bank account using cloned Aadhaar details. Singh alleged that when he went to the Punjab National Bank branch at Mohna Road in Ballabgarh in Haryana’s Faridabad in April, his mother’s passbook showed zero balance though funds had recently been deposited in her account from the sale of land that the family owned. Singh, in his post, wrote that the bank manager told him the account was emptied using his mother’s Aadhaar number and biometric data – her fingerprints. When Singh said she had never shared such information anywhere, the bank manager told him that fingerprints can be hacked or cloned from registry documents for any property. In the months since, several other cases of similar fraud have been reported, prompting the State Bank of India and the Karnataka cyber police to advise customers to “lock” their biometrics on the Aadhaar website to prevent misuse.
Stolen fingerprints
Many of these scams involve cloned or fraudulently obtained fingerprints and the Aadhaar-enabled Payment System, or AePS. The modus operandi is largely the same: stolen fingerprints are used to make copies, often using silicone, which are then used to authenticate financial transactions via Aadhaar, siphoning money directly out of bank accounts. The Aadhaar-enabled Payment System requires customers to enter their Aadhaar number into swipe machines and authenticate a transaction – obtaining cash, for instance – by placing their finger on an attached scanner. A cyber police officer in Haryana police told Scroll that fraudsters steal fingerprints from land revenue documents that are publicly available on the government’s official website for land record documents. Muktesh Chander, Goa’s former director general of police and an expert on cyber security, explained how it is done. “A silicone-based latex glue is used to generate a skin-coloured fingerprint clone from the documents,” he said. Then, the fraudster sheaths their thumb or finger with this fake fingerprint to con the biometric scanner. “This is possible either because of the negligence of those running the swipe machines or their connivance.” Satendra Yadav, a security consultant at Paladion Network, a cyber security firm, said Aadhaar authentication scanners used at Aadhaar Kendras run by the UIDAI, or Unique Identification Authority of India, only accept the live touch of a human. “But scanning systems of private operatives are not sensitive to liveliness of touch,” said Yadav. This allows scammers to use fake fingerprints, such as rubber clones or digital prints, to authenticate the identity of the person. “It can be called an Aadhaar-based breach at end-user applications like banks or PDS,” said Yadav, referring to the public distribution system. In September, the Kolkata police asked the state finance department to mask biometric information and Aadhaar card numbers of those who have uploaded land deeds to the state’ property registration website. Cybersecurity and digital technology experts Scroll spoke to said locking biometrics may offer some level of protection but does little to address the inherent weaknesses in an ever-expanding Aadhaar-linked digital ecosystem. Many of these problems, they say, stem from the insistence of the government over the years to link Aadhaar with various services, such as bank accounts, PAN cards, phone numbers and voter IDs. Aadhaar is also the de facto ID proof to access welfare programmes and subsidies that a vast population is dependent upon.
How AePS works
The Aadhaar-enabled payment system allows account holders to carry out basic transactions, including cash deposits and withdrawals, using Aadhaar biometric authentication. Bank accounts must be linked to Aadhaar numbers to carry out these transactions. One of its aims is the financial inclusion of Indians in rural and remote areas where there are few bank branches and low familiarity with facilities such as debit cards or ATMs. According to the National Payments Corporation of India, AePS payments can be carried out through business correspondents, who are authorised by banks to represent them. Aadhaar authentication has widespread use. In April alone this year, the government said there had been more than 200.6 million, or 20 crore, last-mile banking transactions through the Aadhaar-enabled Payment System and the network of micro ATMs. Yet, frauds are widespread. In October 2021, economist Jean Dreze, along with researcher Vipul Paikra, had written about a range of scams that were exploiting the Aadhaar-enabled payment system. For instance, business correspondents were found to be short-changing customers.Those forced to rely on Aadhaar, such as the marginal and poor in urban and rural areas who need to access government subsidies and welfare programmes, have been the major victims of such scams. Since affluent Indians in urban India do not use subsidies or rely on Aadhaar-enabled payment systems, their risk of biometrics being compromised has been lower. That seems to be changing.
The ‘mandatory’ bank linkage
In mid-2017, the government ordered all customers to mandatorily link their bank accounts with their Aadhaar numbers by the end of the year or risk having their accounts made temporarily inoperable. In September 2018, the Supreme Court ruled that such linking was not mandatory. But by then several Indians had already linked their bank accounts with their Aadhaar. “What they didn’t know was that while they were linking, they were also activating a new instrument,” said Srikanth Lakshmanan, a digital security expert and researcher. Linking Aadhaar and bank accounts automatically activates the Aadhaar-enabled Payment System. Cybersecurity expert and digital technology researcher Srinivas Kodali drew parallels with bank-issued payment methods to explain how this has become a major vulnerability. Banks offer customers different kinds of payment instruments, like credit and debit cards, and facilities such as internet banking and phone banking. But when someone opens a bank account, they do not have access to any of these. “You have to apply for them,” said Kodali. “In your form, you have to tell the bank manager, you want internet banking and you want a debit card. But the UIDAI, Kodali said, believes that marginalised or rural people will not know how to opt-in or opt-out of the AePS. “If the idea is to do default opt-in for the entire population when you link Aadhaar, then your bank should ideally give you an option to opt-out,” he said. A public password Kodali said that data theft and fraud are problems in other payment instruments too, like credit cards, which give you a range of controls such as blocking the card, setting transaction limits or changing PINs. “That option doesn’t exist with AePS with Aadhaar,” said Kodali. Kodali drew a parallel: Aadhaar is the user ID while biometrics are the password. “And unfortunately, you can’t change that,” he said. “Your password is public. ”Suppose your password is leaked in a cybersecurity attack, then someone can access your account, said Kodali. “But by design, what you do then is you allow changing of passwords.” He said all major services allow users to change their passwords, even banks and internet banking. “But by design, with Aadhaar, you can’t change your password.” Because if your biometrics are your “password”, changing that is impossible Biometrics are a “public” password, said Kodali, because “you leave your fingerprints everywhere.”
#modernplasticsaward #plasticnews #modernplasticsgermany #ginujoseph #modernplastic #plasticindia #plasticrecycling #sustainability #modernplasticsglobalnetwork #modernglobalnetwork #modernplasticsaward2023 #plasticmagazine #PlasticIndustry #modernplasticsmiddleeast #indianmagazine #innovations #modernplasticsamerica #modernplasticsbangladesh #modernplasticsasia #modernplasticsitaly
