Kathmandu, November 26

Banks and financial institutions are gradually replacing the existing debit, credit and pre-paid magnetic strip cards with chip-based cards, but none of the automatic teller machines in the country are chip-compliant till date.

However, it has been reported that half of the PoS terminals are chip-compliant. There are around 1,900 ATMs and 3.5 million card users in Nepal.

The BFIs decided to shift to chip-based cards abiding by the provision of Nepal Rastra Bank circular issued on August 18, 2015. Though the NRB circular had instructed BFIs to replace the existing magnetic strip cards with chip-based cards, it is silent about upgrading the ATMs to make them chip-compliant.

At present, the BFIs are replacing magnetic strip cards with combo — containing both magnet strip and chip — cards citing that many countries in the world, including developed nations, have not completely replaced magnetic strip cards with chip-based cards even though the deadline given by Visa and MasterCard is drawing closer.

Visa and MasterCard have fixed a deadline of October 2017 to replace magnetic strip cards with chip-based cards to minimise the risk of card fraud.

“Magnetic strip cards are being replaced by combo cards because apart from Malaysia, almost all other countries have not implemented chip-based cards and Nepali card users will not be able to use their cards while travelling abroad,” said Bijendra Suwal, deputy general manager of IT, Cards, Remittances and Product Development at Nepal Investment Bank. “Upgrading ATMs to make them chip-compliant will be our next step after replacing magnetic strip cards with combo cards.”

Simply replacing the magnetic strip cards does not ensure the clients are safe as the acquiring terminals also need to be chip-compliant to minimise the risk of data theft. It is reported that there is low risk of data compromise in chip-based cards than in magnetic strip cards.

The recent ATM fraud case in Kathmandu Valley has shown that data of magnetic strip cards are fraud-prone as data can be easily copied by installing devices that look like a part of the ATM such as skimming devices, hidden cameras and false keypads, among others.

Hence, due to lack of chip-compliant ATMs, the risk of data theft from ATMs is high in the country. If BFIs upgrade their ATMs to be chip-compliant, it will boost the confidence of card users. However, there is also a risk in upgrading to chip-compliant ATMs because if the fraud is committed through magnetic strip cards in chip-compliant acquiring terminals, the card issuer will not be liable to settle the account.

As per rules of the card payment industry, the issuer is responsible for transactions that are made through magnetic strip ATMs or PoS terminals and for chip-based cards from chip-compliant terminals and PoS.

The liability, however, cannot be shifted to the card issuer if transactions are made through magnetic strip cards in chip-compliant terminals or through chip-based cards in magnetic strip acquiring terminals.