Prices for stolen Indian payment cards has also gone up by 150% in 2018 to around $17/card.
By Catalin Cimpanu for Zero Day | April 19, 2019 — 04:20 GMT (21:20 PDT) | Topic: Security
Due to a booming cybercrime scene, India is expected to surpass the UK in 2019 and become the second-most targeted country for payment card fraud, behind the undisputed leader, the US.
According to cybercrime statistics compiled by cyber-security firm Gemini Advisory, over 3.2 million Indian payment card records have been compromised and posted for sale online in 2018, a big jump from the previous year, when details for only 800,000 Indian payment cards had been posted on cybercrime forums.
India is the perfect target for cybercrime
The sudden attention that India is receiving makes a lot of sense. The country is anticipated to overtake China to become the most populous country in the world by 2024, and India’s economy is expected to surpass the UK economy by the end of the year.
Coupled with a boom of India’s middle class and the government’s efforts to digitize the country, more and more Indians are now in possession of a payment card.
But this sudden rise in valid payment cards has not been accompanied by similar investments in payment card security from the banking sector.
Indian banks remain easy to hack, e-banking solutions are riddled with security flaws, and the ATM network is not under the same close observation like ATM networks in other countries, creating a fertile ground for cyber-attacks and financial fraud.
Card fraudsters recommend India
And the cybercrime scene has noticed. For starters, the country’s neglected ATM network is now the place where most groups will try to cash-out stolen funds using cloned cards.
“Threat actors in the dark web have previously recommended India as an ideal location for using ATMs to cash out of various compromised European cards with PIN data,” Gemini Advisory researchers Stas Alforov and Christopher Thomas said in a report released yesterday.
Similarly, because most Indian banks don’t employ modern anti-fraud systems, Indian payment cards are also in hot demand, as they can be easily cloned and cashed out en-masse.
Alforov and Thomas note that this realization on the side of cyber-criminal groups has led to a 150 percent surge in the sale price of Indian payment cards, which are now in hot demand.
From a median price of $6.90 (approx. 478.02 Indian Rupees) in 2017, the average price for an Indian payment card is now at $17 (approx. 1,177.73 Indian Rupees).
Indian banking sector slowly fighting back
However, the Indian financial sector has noticed cyber-criminals’ attention as well, Gemini noted.
The most important measure the Reserve Bank of India (RBI) has taken in recent months to combat this sudden rise in payment card fraud was to mandate that all ATMs and point-of-sale (POS) devices become EMV-compatible by January 1, 2019.
Gemini says that by introducing and switching to EMV technology, cyber-criminal gangs will have to invest more time, effort, and funds into cloning EMV chip-based cards, rather than having to capture and clone only a magnetic stripe, as they did until recently.
But how much the switch to EMV technology will decrease payment card fraud is unknown. The country’s population, middle class, and economic boom might keep India as an attractive target for many cyber-criminal groups.