In a bid to make electronic payments more secure, the government has released the draft rules for transactions made through prepaid payment instruments (PPIs) like mobile wallets, smart cards and paper vouchers. The draft IT (Security of Prepaid Payment Instruments) Rules 2017, formulated by the Ministry of Electronics and Information Technology (MeitY) will ensure adequate integrity, security and confidentiality of electronic payments effected through PPIs. Till date, these instruments are not governed by norms or rules, as far as cyber security issues are concerned.
As per the draft rules, the PPIs need to ensure end-to-end encryption of the data exchanged. Besides, the e-PPI issuers should assist customers with regard to secure use of the prepaid payment instruments and should have a privacy policy posted on its website. They will also have to appoint a chief grievance officer, whose contact details will have to be prominently displayed on the website and procedure by which customers or any other person who suffers as a result of violation of these rules can make complaints to the Grievance Officer.
Furthermore, the PPI issuer will also need to establish a mechanism for monitoring, handling and follow-up of any cyber incidents and breaches. The rules also specify that every wallet issuer should review its security measures at least once a year, and after any major security incident or breach, or before a major change to its infrastructure or procedures. The last date for submitting comments on the draft is March 20.