Will banks use Aadhaar while migrating to EMV?

A year back, India's apex bank--the Reserve Bank of India (RBI)--announced measures to check credit and debit card frauds by announcing a complete migration to EMV Chip and PIN based cards.

India is one of the fastest-growing countries in the card payment segment, recording an annual growth rate of 30 percent for the past five years. There are already 130 million cards in circulation and this number is estimated to reach 250 million by 2015.

However, security continues to be a big concern for consumers, as India, like the U.S., still uses magnetic stripes on its debit and credit cards. This situation needs to be rectified as lost, stolen and counterfeit card fraud costs INR 130 million (US$2.37 million) a year.

The RBI had thrown its weight behind the EMV (Europay, MasterCard, Visa) standard, which uses a chip and PIN system to deter card fraud. It directed banks to migrate to EMV chip cards and PIN-based cards by Jun. 30, 2013. Instead of swiping their magnetic-stripe card, people insert the card into a reader and enter a PIN.

It appears there is a possibility Aadhaar biometric authentication may be used as a two-factor authentification (instead of the PIN). A notification dated Sep. 22, 2011, from the RBI said: "The position of Aadhaar-based biometric authentication as a second-factor authentication for present card transactions would be reviewed toward the end of December, 2012, to assess the need for a complete switch over to EMV Chip and PIN technology for card-based transactions. It is, however, clarified that banks are free to migrate to EMV Chip and PIN-based technology based on their commercial judgment and decisions taken by their Boards. It is further clarified that RBI is technology-neutral with respect to type of PIN and its nature (static or dynamic)."

Enrolments under Aadhaar have taken place rather smoothly (in the first phase 200 million have been enrolled). I haven't come across too many people who faced difficulty in getting enrolled.

But then, the project has been a subject of much debate and controversy over the security of biometric data. Therefore, the government decided to create a National Population Register (NPR) responsible for collecting information on specific characteristics of all usual residents in the country. The NPR would have photographs, 10 fingerprints and two IRIS prints of all usual residents who are of aged five years and above. As per the approved procedure, NPR database would be sent to Unique Identification Authority of India (UIDAI) for de-duplication and generation of Aadhaar Number.

The government would issue a Resident Identity (smart) Card (RIC) under the NPR. According to news reports, the NPR is likely to get delayed (beyond its deadline of June 2013).

Both Aadhaar and NPR have created a lot of confusion. From what one understands, it is the RICs (and not the Aadhaar number) that would be used for verifying identity and the delivery of government programs, the public distribution system, and electoral and other financial services. Although the RICs would include each person's 12-digit Aadhaar number, it would come with a microprocessor chip so that it can be used in an offline mode as well.

While the RBI has suggested that Aadhaar-based biometric identification could be used instead of PINs for all credit and debit card transactions (including at ATMs and points of sale), one wonders whether banks will actually go ahead and use Aadhaar for identification, given the various debates over security of the biometric data.