India's Mandate re: Stronger Authentication for Card Not Present Use

In February of this year, the Reserve Bank of India adopted new rules on credit and debit card transactions within India that became effective today, August 1, 2009. The rules require India's banks to support two basic capabilities:

• A system of providing for additional authentication/validation based on information not visible on the cards for all on-line card not present transactions (e.g., Verified by Visa or MasterCard SecureCode)
• A system that provides "Online Alerts" to the cardholder for all 'card not present' transactions of the value of Rs. 5,000 (about US$104) and above

Here's an example of one card issuer's approach (Barclaycard) to educating its cardholders. Note the Q&A: "Can I opt out of VBV? No, this is not optional. All online transactions will have to go through VBV process."

In an article in yesterday's edition, India's Economic Times reported that "bankers hail additional authentication for card purchases" - noting that "customers will have to register their cards from tomorrow onwards with the respective merchants--Visa or Master Card and create a security password." A followup article in tomorrow's edition of the Economic Times asks whether the new mandate goes far enough!