Fraud gangs have become active by abusing the system of updating and linking National Identity Card with bank account. Attempts to steal banking details of customers through fake SMS and websites are increasing due to the fear that banking services will be closed, due to which lakhs of rupees of Nepali citizens are at risk. A suspicious SMS sent to the customer said, "Your mobile banking service will be suspended within 24 hours due to missing National Identity Card (NID) link. Please update." Then a link is given which looks like Nabil Bank but is not related to the official website of the bank.
Looking at the address like nabil-bank-kyc.*****.app used in the message, it seems that it is not the official domain of the bank. But since the bank name, NID and service closure warning are used at the same time, there is a high risk of common customers mistaking the information for the real bank and opening the link. The NID arrangement of Rashtra Bank is a weapon of fraud
After linking the National Identity Card with the banking system and the requirement to update the details within the specified time, the customers have become sensitive to the information regarding NID update. Fraudsters are taking advantage of this situation. The customer is pressured to make an immediate decision by sending messages like “NID update by August”, “Your banking service is being stopped” or “Update details within 24 hours”. Then one can be taken to a fake website that looks like a real bank and asks for bank account, mobile number, password, OTP or other sensitive details.
In this way, although the purpose of updating NID is related to security and identity verification, the environment where the customer has to provide details by opening a link or filling a separate form has given fraudsters a new opportunity. Why not create a system where the bank can take government details safely? A national identity card is an official document of a citizen in the government's system. In such a situation, the question has arisen that a system can be developed to verify or coordinate the necessary details through a secure system between the bank and the relevant government agencies. If the details already available in the government system can be verified by the bank through an authorized secure system, it may not be necessary to make every customer fill the details individually through SMS, link or online form.
Citizens with less technical knowledge are most at risk when customers have to distinguish between real and fake links. Fraudsters are also using this confusion as their main weapon. The biggest weapon is the fear that the service will stop In phishing scams, criminals usually employ a strategy that gives the customer no time to think. After warnings like “mobile banking closes within 24 hours”, “account freeze”, “update KYC immediately”, customers may open the link with fear. Such fake messages look more credible when there is a genuine need for NID update. In other words, criminals are preparing fake procedures using the names of real government and banking systems.
The problem will not be solved simply by imposing responsibility on the citizens Simply saying “customer beware” every time a fraud occurs is not a sufficient solution. The incident of stealing funds from bank accounts by tricking citizens in Nepal has not started now. For years, people's money has been stolen by using phishing links, fake phones, OTP fraud, mobile banking and wallet names. People with access, technical knowledge or connections can go to the relevant authorities after fraud and complain, but ordinary citizens may not have even the basic knowledge of where to go after fraud, who to report and whether the money can be returned or not.
When there are still a large number of citizens who do not know what a website is, how to recognize an official domain, what is the difference between a fake link and a real link, the system of forcing citizens to open links again, fill online forms or update personal details in the name of regulation can become risky in itself. Although the objective of updating the national identity card is not wrong, its implementation is done in such a way that citizens have to distinguish between fake and real links, but it is a serious weakness.
Basic details like customer name, citizenship, mobile number, address, KYC are already available in the bank. The government has an official database of national identity cards. In such a situation, instead of requiring citizens to repeatedly open new links and provide details, a secure, authorized and automated authentication system could be developed between banks and government systems.
If such a system was in place, not only the time of citizens would be saved, but also the effect of phishing links created in the name of NID update, fake KYC websites and fraudulent messages like “service will be closed within 24 hours” could have been reduced to a large extent. It could have helped protect even the huge financial sums now at risk from such frauds.
An easy solution is to put all the onus on the citizen and say “check the link”, “don't give OTP” and “be aware”. But the real solution is to make the system secure so that citizens don't have to distinguish fake links. It seems that linking government identification systems like national ID cards with banks should be based on a secure data authentication system between the government and the bank, rather than depending on the technical knowledge of citizens.
The purpose of the National Identity Card updating system is to secure the banking system. But when the same process is becoming a new weapon for fraudsters, the regulatory body needs to review its implementation model. The government has the citizen's details, if the bank also has enough details about the customer's identity, instead of finding a way to secure authentication between the two systems, forcing the citizen to open the link again and again to provide the details cannot be a long-term solution.
