SMS Archives « Aam Janata

My PayTM Misadventure 10

godavarNovember 24, 2016November 25, 201610 Comments

At around 830 pm on Monday, Nov. 21, my phone was stolen from me. The incident occurred at the crowded Saket Metro bus stop, while I was inside a feeder bus and the thief outside a window. By the time I could get off the bus and chase him, he had disappeared in the crowd. I looked around for a while before returning home, determined to do all I legally and possibly could in such a case, but feeling hopeless and dejected.

Primary concern, ensuring security

I filed an e-FIR, used Android Device Manager to try and locate the phone, placed a request to erase data with the Manager as well as my office IT service center. I knew that I had logged out of banking apps and they could not be accessed without MPins, but the PayTM app had login details saved. So I tried to lock my PayTM account via their website. Shocker: to verify my login they needed me to enter, apart from my e-mail/phone number and password, an OTP which I could only receive via SMS or call. I wondered why they could not e-mail me the OTP as well, which is standard practice in 2-factor authentication. I then used their customer care page to request a block on my account. I received an acknowledgement of this request almost instantly, (940 pm, Nov. 21, query #10133775). However, I received no reply, so I took to Twitter (1159 pm, Nov. 21):

@Paytmcare my phone got stolen this evening. can you lock my PayTM app?
— Raghu /godavar /#DestroyTheAadhaar /#UrbanNaxal (@godavar) November 21, 2016

Next morning, I see no response to my e-mail, but see this response to the tweet (735 am, Nov. 22):

Hi, We can block your account. For this please mail us from your registered email id. So that we can block!
— Paytm Care (@Paytmcare) November 22, 2016

So I sent them another e-mail request which was again acknowledged (0904 am, Nov. 22, query #10152004). Again, no reply, even by the evening, so I reply to their tweet:

have sent you the e-mail in the morning. can you please suggest how long it might take to block?
— Raghu /godavar /#DestroyTheAadhaar /#UrbanNaxal (@godavar) November 22, 2016

This tweet, unsurprisingly, did not get any response. In the meanwhile, I had not only got a replacement SIM card from Airtel, but also had the SIM cards activated within the estimated time of 4-6 hours, despite being told that there may be a further delay as my number had been barred due to filing the FIR. I was thus able to receive the OTP now via the on call option (SMS services took a further 24 hours, as estimated, to get reactivated), and logged into PayTM.

It took me less than five minutes to change my password, and also log myself out of all devices. But I had to wait nearly a full day to do it because of the infuriating lack of response from PayTM. Compare this with the speed of transactions on PayTM. If you had to wait 22 hours for your PayTM wallet to be recharged, or if PayTM took 22 hours to pay your Uber cab fare, they would not remain in business very long, would they? So why do they assume they can take their own sweet time about customer service?

I quickly used up the balance in my PayTM wallet in order to close the account. I waited for a day to ensure those transactions did come through, and then tried closing my account this evening. Surprise, surprise. There is no option on the site to close your account, not even among their myriad customer care options. My requesting customer care to do so got me the no-less-surprising response that "Paytm account cannot be deleted, but we can block it for you please help us with the mail form your registered email id stating the same." Bank accounts can be closed, social media accounts can be deleted (I just deleted my WhatsApp account this evening, in under 5 minutes), but a PayTM account cannot be deleted. Why is this so?

Again, for a digital service, PayTM's frankly ridiculous, repetitive insistence on e-mail confirmation is nothing short of painful, especially given that there is NO guarantee your e-mail will actually merit a response from them, as so amply demonstrated by this experience.

Update: @Paytmcare chose to respond to this story via both tweet (0242am, Nov. 24) and e-mail (0615am, Nov. 24). The tweet asked me to check my email with reference to the request for closing my account (query #10291894). Only, their reply was to my e-mail of Nov. 22 (query #10152004). Not only did they get this mixed up, their response was on how I could get a new mobile number updated in my account while my old number was inaccessible - whereas my query had been about blocking my account. At this point, I could only conclude that PayTM's customer care is, in addition to being poorly managed, is also poorly trained to respond to customer queries. And yes, PayTM has not yet confirmed that my account has been blocked, as of 0925am, Nov. 25.

For those interested, I have Storified the full exchange with @Paytmcare on Twitter, and my tweetstorm on the overall experience, here:

https://storify.com/godavar/a-misadventure-in-digital-dystopia-my-paytm-story

P.S. the image for this post is a fully deliberate reminder of the fact that PayTM chose to be cheerleaders for the disastrous #demonetization in India.

Is HDFC Bank letting Justdial steal your money? 4

Sulaiman BhimaniOctober 27, 2016October 27, 20164 Comments

27^th October, 2016, Navi Mumbai: Here is a real-life thriller. Justdial starts plundering the bank account of an HDFC Bank customer, while the bank acts like an helpless bystander. After the dust settles, the bank tells its customer to go to the police, while it does absolutely nothing to prevent Justdial from robbing other customers. In May 2016, Sanjeev Goel, managing partner of a coaching academy called Pure Energy Academy in Belapur, Navi Mumbai, signed a contract with Justdial for business promotion. June onwards, Justdial started sucking unlimited amounts of money from Pure Energy's bank account by using a fraudulent Electronic Clearance Service (ECS) mandate. Although the bank managers now understand how the crime was perpetrated, they refuse to take steps to protect thousands of customers from Justdial and other fraudulent companies following the same modus operandi. HDFC Bank's excuse is that National Payment Corporation of India (NPCI) – which handles ECS transactions -- does not require them to do so. HDFC Bank is ignoring RBI's guideline which explicitly requires them to confirm the ECS mandate with their customer first.

How Justdial cheats

Pure Energy Academy's contract with Justdial was for payment of Rs 1040/- per month, for a period of one year. See the terms of contract below.

Two cheques were issued towards the first two monthly payments. However, Justdial activated the contract a day after depositing both the cheques on 3^rd June. The delay of one month in depositing the first cheque appears to be because the signature, stamp and other details of the cheques contained were being used by Justdial's backroom boys to creat a forged ECS/NACH mandate form enabling them to charge upto Rs 1040/- as many times in a month as they wished. With this phony mandate, Justdial could directly withdraw limitless money from Pure Energy's bank account by presenting the ECS/NACH mandate for the next 14 years! Also, the ECS mandate was made out to be non-cancellable! See the forged ECS/NACH mandate below.

(Note: take a close look at this document; it is so obviously fishy! All the options are pre-tick-marked and cancelled in the printed form itself. They are not tickmarked or cancelled by hand, the form is printed that way! Even the supposed termination date of the contract – 31/03./2030 – is printed, and only the starting date is entered by hand. The frequency options i.e. Monthly, quarterly, half-yearly and yearly, are all pre-cancelled in the printed form, and "As and when presented" is pre-tickmarked. The debit type option of "Maximum amount" is also pre-selected in the printed stationery. Also notice that something has been pasted on top of the form, partly covering the words "Client" and "Reference" on the left-hand-side. Like a cheque, the ECS mandate is a negotiable instrument, so how can it have a pasted-on layer? Aren't negotiable instruments rejected by banks if there is pasting, over-writing etc.? This ECS mandate defies commonsense!)

Using this dubious ECS mandate, Justdial started guzzling money from Pure Energy Academy's bank account. Justdial encashed both the cheques on 3^rd June, and debited Rs 1040/- on 30^th June by ECS – three debits in the first month of the contract. Despite Sanjeev telling them to terminate the contract, Justdial debited Rs 1040/- in July, August and September, plus Rs 110/- twice in September. Within four months, Justdial took payment for more than six months.

See Statement of Account below.

Pure Energy Academy's stop-payment instructions over net-banking and email, starting 31^st August, were ignored, sidestepped and buck-passed by HDFC Bank. The bank stopped the ECS mandate only on 10^th October. The bank's actions of commission and omission need a closer scrutiny.

How HDFC Bank turned a blind eye

1) HDFC Bank did not seek its customer's confirmation of this ECS mandate. Although the ECS mandate presented by Justdial defies logic (allowing unlimited withdrawals for 14 years) Defying RBI's clear directions, HDFC Bank never sought Sanjeev's confirmation of the ECS mandate. Had this basic step been taken, many clear signs of forgery and contradictions between Justdial's contract and the ECS mandate would have come to light.

2) HDFC Bank did not send him SMS alerts when money was debited by Justdial. So Sanjeev did not notice this unusual activity until 31^st August, 2016, when he got his accounts statement. Then he raised an alarm, wirinting to both Justdial and HDFC Bank executives. Both responded with delaying tactics, vagueness and buck-passing.

3) HDFC Bank managers are inadequately trained, ill-informed and non-committal. The bank managers clearly did not know where the original instrument i.e. ECS/NACH mandate, was to be found. The Belapur Banch Manager and others kept giving false promises, saying that they had initiated the process of getting the original ECS mandate, and it would land on their table within a few days. They contradicted themselves and each other repeatedly in this and other ways. Finally, on 15^th October, they washed their hands off the whole problem, arguing that since NPCI had the original copy of the mandate, they were not authorized to access it. What the HDFC Bank managers advised Sanjeev was, "Let the police register an FIR against Justdial, then they will requisition the original copy of the ECS mandate from NPCI and scrutinize it as part of their investigations. We are no longer involved in your problem." However, they said this orally and refused to put it down in writing.

HDFC Bank refuses to compensate Pure Energy Academy by reversing the debits. After belatedly examining the copy of the ECS mandate on 3^rd October, it became clear to the branch manager and others that this was a case of fraud and forgery, but they refused to take any action. Their final stand is that Sanjeev must file a police complaint. If and only if the police register an FIR against Justdial, HDFC Bank will consider reversing the debits. This also is only a feeble oral statement, and the bank's managers are unwilling to even talk about it with any certainty.

But what if the police does not register FIR? Suppose the police takes the stand that this is a banking issue, and therefore, they have no understanding of it, and therefore, Sanjeev should complain to appropriate authorities in the banking domain? Then Sanjeev will effectively be left with no remedies, and Justdial will get away scotfree! For HDFC Bank, however, it will just be business-as-usual.

ISSUED IN PUBLIC INTEREST BY
Krishnaraj Rao
9821488114
krish.kkphoto@gmail.com

Note: Other equally serious issues have come to light. A whole lot of arbitrary and questionable debits are being made by this bank, without the customers' permission. We will focus on those issues in our next article.

POSTED IN PUBLIC INTEREST BY

Sulaiman Bhimani

+91 9323642081

sulaimanbhimani11@gmail.com

A technology based security idea for Delhi 19

VidyutDecember 19, 2012August 2, 201719 Comments

Would it be possible to create some kind of network of wifi receptors all over the city? Or use an existing network (Tikona, for example) to scan for distress signals from phones or other devices? The range of a wifi being relatively small, it shouldn't be too complicated to mark a fairly accurate area to dispatch cops.

This is the hardware.

The software will be on multiple levels.

On the user's end, it can be a simple phone application. Or it can be an alarm installed in a building or it can be sent from a laptop or other computer. When an alarm is triggered, basic information on location if any from the device GPS, phone number and the call for help should be broadcast from wireless, as well as SMS. It should continue to broadcast periodically on wireless as well as send SMS if any information changes (location, phone number, whatever). The phone must automatically start recording audio and switch to silent mode.

The application in all its forms should have the ability to pick a distress signal and communicate information to the police - or, in the absence of both phone and internet connectivity, bounce the signal further and enhance its reach. It should relay any return signal back as well in a similar manner. In this manner, all available wifi enabled phones could be used to support the police network.

On the police end, receiving a signal should result in the police network being informed and dispatched as per their protocols - treating it like a phone call to the police line with address information attached. The operator must attempt to call and confirm the emergency. This call May or may not be picked by the person depending on circumstances.

Police vans must have wifi capabilities of smaller range, to be able to further narrow down the location.

Such a solution should not be too difficult to design. Wifi capabilities exist as well as mesh networking research. This will not need anything major. In fact, the more primitive, the less open to exploitation.

Such a system also has fewer chances of misuse, as it will be designed to transmit all possible personally identifying and locating information. This would be scalable as well as reproducible in other parts of India.

Basic networks once established could aid in all kinds of things.

Will refine the idea as needed, but what do you think? Good idea?