💳 Payment Security
Complete Study Notes for Banking, SSC, UPSC, Government & Railway Competitive Exams
🇮🇳 India-Specific: UPI, RBI, NPCI 📊 All Key Tables & Comparisons 📝 50+ Exam MCQs ⚡ Quick Revision Sheet12
Topic Sections
50+
MCQs with Explanations
15+
India RBI/NPCI Policies
8
Comparison Tables
1. What is Payment Security?
Payment Security refers to the set of technologies, standards, policies, and practices used to protect financial transactions from fraud, theft, unauthorized access, and cybercrime. It covers card payments, online banking, mobile wallets, UPI, ATM transactions, and more.
Why it Matters in Exams: Banking, SSC-CGL, IBPS, RBI Grade B, SBI PO, UPSC, and State PSC exams regularly test knowledge of payment systems, RBI guidelines, UPI, PCI DSS, tokenization, and fraud prevention. This is a high-scoring, predictable topic if you study the right things.
| Security Goal | In Payment Context | Example |
|---|---|---|
| Confidentiality | Card details not exposed to unauthorized parties | TLS encryption for online transactions |
| Integrity | Transaction amount not altered during processing | Digital signatures on payment messages |
| Availability | Payment systems work 24×7 without downtime | Bank servers resistant to DDoS attacks |
| Authentication | Verifying the identity of the person making payment | OTP, PIN, biometrics for UPI payments |
| Non-Repudiation | Sender cannot deny initiating a transaction | Digital receipts, transaction logs |
2. India’s Payment Ecosystem — Key Organizations
| Organization | Full Form | Role |
|---|---|---|
| RBI | Reserve Bank of India | Apex regulator of all payment & settlement systems in India; issues guidelines for banks, fintech firms |
| NPCI | National Payments Corporation of India | Operates UPI, RuPay, IMPS, NACH, FASTag, Aadhaar Pay, BBPS — India’s payment infrastructure body |
| DPSS | Dept. of Payment & Settlement Systems | RBI department that regulates payment systems in India |
| IDRBT | Institute for Development & Research in Banking Technology | Technology research arm for Indian banking sector |
| SEBI | Securities & Exchange Board of India | Regulates securities market payments & settlement |
| IRDAI | Insurance Regulatory & Development Authority | Regulates insurance premium payment security |
| CERT-In | Computer Emergency Response Team – India | National incident response for payment security breaches |
| PCIDSS Council | Payment Card Industry Security Standards Council | Global body setting card payment security standards |
Key Fact: The Payment & Settlement Systems Act, 2007 is the law governing payment systems in India. It gives RBI the power to regulate, supervise, and authorize payment systems.
3. UPI — Unified Payments Interface (Most Exam-Relevant)
UPI (Unified Payments Interface) is a real-time payment system developed by NPCI that enables instant money transfer between bank accounts through mobile devices using a Virtual Payment Address (VPA).
| UPI Fact | Details |
|---|---|
| Launched by | NPCI (National Payments Corporation of India) |
| Launch Year | 2016 (NPCI) — publicly available from April 11, 2016 |
| Approved by | RBI (Reserve Bank of India) |
| Daily Limit | ₹1 lakh per transaction (₹2 lakh for some verified transactions) |
| Unique Identifier | VPA (Virtual Payment Address) — e.g., name@bankname |
| Authentication | Device binding + UPI PIN (4 or 6 digit) |
| Underlying Technology | IMPS (Immediate Payment Service) rails, 24×7 availability |
| Security Layer | End-to-end encryption, 2FA (device + PIN), real-time fraud monitoring |
| Global Expansion | Now available in: Singapore (PayNow link), UAE, UK, France, Bhutan, Nepal, Mauritius |
| Apps using UPI | Google Pay, PhonePe, Paytm, BHIM, Amazon Pay, WhatsApp Pay |
👤 Payer
Enters VPA & amount
Enters VPA & amount
→
📱 UPI App
Authenticates via PIN
Authenticates via PIN
→
🏛️ Payer’s Bank
Debit request
Debit request
→
⚙️ NPCI
Routes & settles
Routes & settles
→
🏛️ Payee’s Bank
Credit
Credit
→
✅ Recipient
Money received
Money received
- Device Binding: UPI is linked to a specific device + SIM — cannot be used on another phone without reverification
- UPI PIN: Mandatory 4 or 6-digit PIN for every transaction — different from ATM PIN
- Two-Factor Authentication (2FA): Device binding (something you have) + UPI PIN (something you know)
- End-to-End Encryption: All UPI transaction data is encrypted in transit using TLS
- Real-Time Fraud Monitoring: Banks and NPCI run AI-based fraud detection systems
- Screen Unlock: Phone screen lock adds another layer before UPI app can be opened
- No Card Details: UPI never requires card number or CVV — reduces risk significantly
BHIM vs UPI: BHIM (Bharat Interface for Money) is an app built by NPCI that runs on top of UPI. UPI is the payment system/infrastructure. Both are from NPCI. BHIM was launched on December 30, 2016 by PM Narendra Modi.
⭐ Exam Tips: UPI launched by NPCI in 2016 | VPA = Virtual Payment Address | UPI PIN ≠ ATM PIN | BHIM app by NPCI | UPI uses IMPS rails | PSS Act 2007 governs payment systems | UPI linked to Singapore’s PayNow for cross-border transfer
4. PCI DSS — Payment Card Industry Data Security Standard
PCI DSS is the global security standard for organizations that store, process, or transmit credit/debit card data. It was created by the PCI Security Standards Council (founded by Visa, MasterCard, American Express, Discover, JCB).
Who must comply? Any merchant, bank, payment gateway, or service provider that handles card payments — worldwide. Non-compliance can result in heavy fines and loss of ability to process card payments.
| # | Requirement | Category |
|---|---|---|
| 1 | Install and maintain network firewalls to protect cardholder data | Build Secure Network |
| 2 | Do not use vendor-supplied default passwords on systems | Build Secure Network |
| 3 | Protect stored cardholder data (encrypt, mask, don’t store CVV) | Protect Cardholder Data |
| 4 | Encrypt transmission of cardholder data across open/public networks | Protect Cardholder Data |
| 5 | Use and regularly update antivirus software | Vulnerability Management |
| 6 | Develop and maintain secure systems and applications | Vulnerability Management |
| 7 | Restrict access to cardholder data by business need to know | Access Control |
| 8 | Assign unique IDs to all persons with computer access | Access Control |
| 9 | Restrict physical access to cardholder data | Access Control |
| 10 | Track and monitor all access to network resources and data | Monitor & Test |
| 11 | Regularly test security systems and processes | Monitor & Test |
| 12 | Maintain an information security policy for all personnel | Security Policy |
⭐ Exam Tip: PCI DSS has 12 requirements grouped under 6 goals | Founded by Visa, MasterCard, AmEx, Discover, JCB | CVV/CVV2 must NEVER be stored after authorization | Latest version: PCI DSS v4.0 (released March 2022)
5. Tokenization in Payments
Tokenization replaces sensitive card information (like the 16-digit card number) with a randomly generated, meaningless string called a token. The token can be used for payments but is useless if stolen — the actual card details remain in a secure vault.
💳 Card Number
1234 5678 9876 5432
1234 5678 9876 5432
→ TSP →
🔖 Token
abcd9876xyz123
abcd9876xyz123
→
🛒 Merchant
Stores token only
Stores token only
→
✅ Payment
Processed securely
Processed securely
| Feature | Tokenization | Encryption |
|---|---|---|
| Output | Random, meaningless token (no mathematical link to original) | Ciphertext (mathematically derived from original) |
| Reversible? | Only by TSP vault lookup — no algorithm can reverse it | Yes — with the correct decryption key |
| Original Data | Stored in a secure token vault (off-site) | Remains (but scrambled); needs key management |
| Scope Reduction | ✅ Massively reduces PCI DSS scope | Does not reduce PCI DSS scope |
| Key Management | No encryption keys needed | Requires secure key management |
| Best For | Card storage, recurring payments, e-commerce | Data in transit, full data protection |
RBI Card-on-File (CoF) Tokenization Mandate — India:
• Effective from October 1, 2022, RBI mandated that merchants CANNOT store customer card details on their servers
• Instead, merchants must use Card-on-File Tokenization (CoFT) — storing only a token
• Tokens are issued by card networks (Visa, MasterCard, RuPay) via Token Service Providers (TSPs)
• Applies to: All online merchants, e-commerce platforms, subscription services in India
• Purpose: Prevent card data breaches at merchant endpoints
• Effective from October 1, 2022, RBI mandated that merchants CANNOT store customer card details on their servers
• Instead, merchants must use Card-on-File Tokenization (CoFT) — storing only a token
• Tokens are issued by card networks (Visa, MasterCard, RuPay) via Token Service Providers (TSPs)
• Applies to: All online merchants, e-commerce platforms, subscription services in India
• Purpose: Prevent card data breaches at merchant endpoints
⭐ Exam Tip: RBI CoF Tokenization = effective October 2022 | TSP = Token Service Provider | Token has no mathematical relation to card number | Tokenization reduces PCI DSS scope | Both encryption AND tokenization are used in payments — they serve different purposes.
6. India’s Payment Systems — Complete Comparison
| System | Full Form | Operator | Transfer Limit | Settlement | Availability |
|---|---|---|---|---|---|
| UPI | Unified Payments Interface | NPCI | ₹1 lakh/txn | Immediate (24×7) | 24×7×365 |
| IMPS | Immediate Payment Service | NPCI | ₹5 lakh/txn | Immediate | 24×7×365 |
| NEFT | National Electronic Funds Transfer | RBI | No upper limit | 30-min batches (24×7) | 24×7 (from Dec 2019) |
| RTGS | Real Time Gross Settlement | RBI | Min ₹2 lakh | Real-time (gross) | 24×7 (from Dec 2020) |
| NACH | National Automated Clearing House | NPCI | Varies | Batch (1-2 business days) | Business days |
| AEPS | Aadhaar Enabled Payment System | NPCI | ₹50,000/day | Immediate | 24×7 |
| BBPS | Bharat Bill Payment System | NPCI | Varies by biller | Immediate | 24×7 |
| RuPay | — | NPCI | Card limit | Per card scheme | Wherever accepted |
| FASTag | — | NPCI | Per toll | Immediate RFID debit | Toll plazas |
Key Differences: NEFT settles in batches | RTGS settles individually in real-time (for large amounts ≥₹2 lakh) | UPI & IMPS are both real-time but UPI uses VPA | AEPS uses Aadhaar + fingerprint for authentication — no card/PIN needed.
⭐ Exam Tips: NEFT = National Electronic Funds Transfer (batch) | RTGS = Real Time Gross Settlement (min ₹2 lakh) | IMPS = 24×7 immediate (higher limit than UPI) | All operated by RBI (NEFT, RTGS) or NPCI (UPI, IMPS, RuPay, FASTag, AEPS)
7. Payment Fraud — Types & Prevention
| Fraud Type | What Happens | How to Prevent |
|---|---|---|
| Card Skimming | Attacker installs a hidden device on ATM/POS to copy card magnetic strip data | Use EMV chip cards; check ATM for skimmer devices; use contactless payments |
| Phishing / Vishing | Fake emails/calls trick users into revealing card numbers, OTPs, or PINs | Never share OTP over phone; verify caller identity; use anti-phishing filters |
| UPI Fraud (Collect Requests) | Attacker sends a UPI “collect money” request pretending to be a refund — victim approves and money is debited | Never enter UPI PIN for receiving money; scrutinize collect requests carefully |
| Card-Not-Present (CNP) Fraud | Using stolen card details for online shopping where only card number + expiry + CVV are needed | Two-factor authentication (OTP); 3D Secure verification; tokenization |
| Man-in-the-Middle (MITM) | Attacker intercepts payment communication between buyer and server | HTTPS/TLS encryption; avoid public Wi-Fi for banking; certificate pinning |
| Account Takeover (ATO) | Hacker gains access to victim’s bank account using stolen credentials | Strong passwords; MFA; anomaly detection; device binding |
| Shimming | A thin insert placed inside card slot to intercept chip card data | Use contactless/NFC payments; check card slot for tampering |
| Synthetic Identity Fraud | Using a combination of real and fake information to create a new identity for fraudulent accounts | Enhanced KYC verification; AI-based identity checks |
| Business Email Compromise (BEC) | Attacker impersonates a CEO/CFO to instruct finance team to transfer large amounts | Email verification; callback procedures for large transfers; dual approvals |
| SIM Swapping | Fraudster convinces telecom to transfer victim’s number to their SIM — intercepts OTPs | Lock SIM with telecom provider; use authenticator apps instead of SMS OTP |
Important: Entering your UPI PIN when you receive a collect request = sending money, NOT receiving it. Cybercriminals exploit this confusion. You never need your PIN to RECEIVE money on UPI.
8. Secure Payment Technologies
| Technology | What It Is | Security Benefit |
|---|---|---|
| EMV Chip Cards | Cards with an embedded microchip (instead of just magnetic strip). EMV = Europay, Mastercard, Visa | Dynamic authentication — each transaction generates a unique code. Defeats card cloning/skimming |
| 3D Secure (3DS) | Additional authentication layer for online card payments. Used in “Verified by Visa”, “Mastercard SecureCode” | Adds OTP or biometric step during online purchase — prevents CNP fraud |
| NFC/Contactless Payments | Near Field Communication — tap card or phone on reader. Works within 4cm range | Uses tokenization; no card PIN for small amounts; reduces physical contact with reader |
| SSL/TLS Encryption | Encryption protocol securing data in transit between browser and payment server (HTTPS) | Prevents MITM attacks; ensures data confidentiality during checkout |
| HSM (Hardware Security Module) | Physical tamper-proof hardware device used to store and process cryptographic keys | Keys never leave secure hardware; protects encryption keys used in banking systems |
| Point-to-Point Encryption (P2PE) | Encrypts card data from the moment of swipe/tap until it reaches the secure decryption environment | Card data is never exposed in readable form at merchant’s system; reduces PCI DSS scope |
| OTP (One-Time Password) | Unique password valid for a single transaction, sent via SMS or authenticator app | Prevents replay attacks — stolen OTP is useless for another transaction |
| TOTP (Time-based OTP) | OTP that changes every 30 seconds, generated by an app (Google Authenticator, Authy) | More secure than SMS OTP — not interceptable via SIM swap |
| Biometric Authentication | Fingerprint, face recognition, or iris scan for payment authorization | Cannot be guessed or shared; used in AEPS (Aadhaar + fingerprint) |
| AI/ML Fraud Detection | Machine learning algorithms analyze spending patterns to detect anomalies | Can block suspicious transactions in real-time before fraud completes |
EMV vs Magnetic Strip: Magnetic strip stores static data — easily copied (skimmed). EMV chip generates a unique dynamic code for each transaction, making copied data useless for another transaction. EMV was introduced to fight card skimming fraud.
9. Key RBI Guidelines for Payment Security
| Guideline / Regulation | Year | What It Mandates |
|---|---|---|
| Payment & Settlement Systems Act | 2007 | Primary law governing all payment systems in India; RBI the designated regulator |
| Card-on-File Tokenization | 2022 | Merchants CANNOT store actual card data; must use tokens from card networks |
| MTSS Guidelines | Updated 2022 | Money Transfer Service Scheme — regulates foreign inward remittance |
| 2FA for all Card Transactions | Ongoing | All online card transactions in India must have second factor (OTP) — AFA (Additional Factor of Authentication) |
| Zero Liability for Victims | 2017 | Customers not responsible for unauthorized transactions if reported within time; bank must refund within 10 days |
| Positive Pay System | 2021 | Mandatory confirmation for cheques above ₹50,000 — prevents cheque fraud |
| NBFC Payments Regulations | 2021 | Strengthened guidelines for Non-Banking Finance Companies offering payment services |
| RBI Data Localisation | 2018 | All payment data of Indian customers must be stored ONLY in India — foreign firms must comply |
| Aadhaar-based eKYC | 2020+ | Allows digital KYC using Aadhaar OTP/biometrics for opening bank accounts and payment wallets |
| Fraud Risk Management (FRM) | Ongoing | Banks must implement FRM systems to detect and prevent payment fraud in real time |
Key India Rule: RBI mandates Additional Factor of Authentication (AFA) for ALL card-not-present (CNP) transactions in India. This is why you always get an OTP before completing an online payment — this doesn’t apply in many other countries, making India safer for online payments.
10. Card Networks & Card Security
| Card Network | Country of Origin | Key Fact |
|---|---|---|
| Visa | USA | Largest card network globally by transaction volume |
| Mastercard | USA | Second largest; co-founded PCI DSS Security Standards Council |
| RuPay | 🇮🇳 India | India’s own card network by NPCI — accepted across India + some international markets |
| American Express | USA | Both issuer and network; premium cards |
| Diners Club | USA | Premium travel and entertainment cards |
| SWIFT | Belgium | International messaging network for cross-border bank payments (not a card network) |
| Feature | Full Form / Details | Purpose |
|---|---|---|
| CVV / CVV2 | Card Verification Value — 3-digit code on back (4-digit on AmEx front) | Proves physical card possession for CNP transactions |
| PAN | Primary Account Number — 16-digit card number | Uniquely identifies the card account |
| Expiry Date | Month/Year printed on card | Added verification for card validity |
| EMV Chip | Europay, Mastercard, Visa chip | Dynamic cryptogram prevents cloning |
| Magnetic Strip | Black strip on card back | Legacy data storage — insecure; being phased out |
| PIN | Personal Identification Number (4-6 digits) | Physical authentication at ATM/POS terminal |
| OTP/AFA | Additional Factor of Authentication | Mandatory 2FA for online card transactions in India |
| Hologram | Holographic foil sticker | Physical anti-counterfeiting feature |
PCI DSS prohibits storing CVV after authorization. Even if a card is tokenized, the CVV must NEVER be stored anywhere. This is the most strictly enforced PCI DSS rule.
⭐ Exam Tip: RuPay = India’s card network by NPCI | CVV must NEVER be stored (PCI DSS rule) | EMV stands for Europay, MasterCard, Visa | SWIFT = messaging for international bank transfers, not a card network
11. Quick Revision Cheat Sheet
UPI OperatorNPCI (National Payments Corporation of India)
UPI RegulatorRBI (Reserve Bank of India)
UPI Launched2016 by NPCI
BHIM AppLaunched Dec 30, 2016 by PM Modi; built by NPCI on UPI
VPAVirtual Payment Address — unique UPI identifier (name@bank)
UPI PIN useOnly for SENDING money — never needed to receive
IMPS Limit₹5 lakh per transaction; 24×7 immediate
RTGS Min Amount₹2 lakh; Real-Time Gross Settlement
NEFT Settlement30-minute batches; no min/max limit; 24×7
AEPSAadhaar Enabled Payment System — fingerprint + Aadhaar
PCI DSS12 requirements for card payment security; global standard
PCI DSS CouncilFounded by Visa, MasterCard, AmEx, Discover, JCB
TokenizationCard number replaced by random token; token useless if stolen
RBI CoF TokenizationEffective Oct 1, 2022 — merchants cannot store card data
EMVEuropay, Mastercard, Visa — chip card standard
CVV StorageMUST NOT be stored by anyone (PCI DSS rule)
3D SecureAdditional OTP step for online card payments (Verified by Visa, SecureCode)
HSMHardware Security Module — stores cryptographic keys in tamper-proof hardware
SWIFTInternational bank messaging network (not a card network)
RuPayIndia’s own card network — developed by NPCI
PSS ActPayment & Settlement Systems Act, 2007 — governs payment systems in India
RBI Data LocalisationAll Indian payment data must be stored in India only (2018)
AFAAdditional Factor of Authentication — mandatory OTP for online card payments in India
Positive PayCheque confirmation above ₹50,000 — prevents cheque fraud (RBI 2021)
Card SkimmingCopying magnetic strip data from ATM — defeated by EMV chip
UPI Collect FraudAttacker sends collect request as fake refund — never enter PIN to receive money
SIM SwappingFraudster takes over your phone number to intercept OTPs
P2PEPoint-to-Point Encryption — card data encrypted from swipe to processor
UPI InternationalLinked with Singapore PayNow; available in UAE, France, UK, Bhutan, Nepal
Zero Liability RuleRBI 2017 — bank must refund unauthorized txn if reported timely
Practice MCQs — Answers & Explanations
50+ questions organized by topic. Green option = correct answer. Based on Banking (IBPS/SBI), SSC-CGL, UPSC, RBI, and State Govt exam patterns. Explanations included for each answer.
🇮🇳 Section A — UPI, NPCI & Indian Payment Systems
1UPI (Unified Payments Interface) was developed by which organization?
- A. Reserve Bank of India (RBI)
- B. National Payments Corporation of India (NPCI)
- C. State Bank of India
- D. Ministry of Finance
✅ Answer: B UPI was developed and is operated by NPCI (National Payments Corporation of India). RBI is the regulator/approver, but NPCI built and manages the UPI infrastructure.
2UPI uses which of the following as a unique identifier instead of bank account number?
- A. IFSC Code
- B. Mobile Number only
- C. VPA (Virtual Payment Address)
- D. Aadhaar Number
✅ Answer: C UPI uses a VPA (Virtual Payment Address) like “name@bankname” as a unique identifier. Users don’t need to share their actual bank account number or IFSC code for UPI transactions.
3BHIM app was launched by PM Narendra Modi in which year?
- A. 2015
- B. 2014
- C. 2016
- D. 2018
✅ Answer: C BHIM (Bharat Interface for Money) app was launched on December 30, 2016, by PM Narendra Modi. It was developed by NPCI to promote UPI-based digital payments.
4Which payment system requires a MINIMUM transaction amount of ₹2 lakh?
- A. NEFT
- B. UPI
- C. IMPS
- D. RTGS
✅ Answer: D RTGS (Real Time Gross Settlement) requires a minimum transaction of ₹2 lakh. It is designed for large-value, time-critical transactions and settles in real-time individually.
5AEPS (Aadhaar Enabled Payment System) uses which factor for authentication?
- A. Username and Password
- B. OTP on mobile number
- C. Aadhaar number + Biometric (fingerprint/iris)
- D. Card number and CVV
✅ Answer: C AEPS allows banking transactions using Aadhaar number + biometric authentication (fingerprint or iris) at a micro-ATM or banking correspondent. No card, PIN, or mobile OTP needed.
6Which payment system in India settles transactions in 30-minute batch cycles?
- A. RTGS
- B. IMPS
- C. UPI
- D. NEFT
✅ Answer: D NEFT (National Electronic Funds Transfer) settles transactions in batches every 30 minutes, 24×7. Unlike RTGS, it’s not real-time — but it has no minimum or maximum limit.
7RuPay is India’s domestic card network. It was developed by:
- A. Reserve Bank of India (RBI)
- B. State Bank of India (SBI)
- C. National Payments Corporation of India (NPCI)
- D. Ministry of Finance
✅ Answer: C RuPay is India’s own card payment network, developed by NPCI as a domestic alternative to Visa and Mastercard. It’s widely used for Jan Dhan accounts and government scheme disbursements.
8The Payment and Settlement Systems Act, 2007 designates which body as the regulator of payment systems in India?
- A. SEBI
- B. NPCI
- C. Reserve Bank of India (RBI)
- D. IRDAI
✅ Answer: C The Payment and Settlement Systems (PSS) Act, 2007 designates RBI as the regulator and supervisor of all payment and settlement systems in India.
9India’s UPI payment system was linked with which country’s PayNow for cross-border payments?
- A. UAE
- B. USA
- C. Singapore
- D. UK
✅ Answer: C India’s UPI and Singapore’s PayNow were linked on February 21, 2023, enabling real-time cross-border fund transfers between India and Singapore using UPI/PayNow IDs.
10NACH (National Automated Clearing House) is operated by:
- A. RBI
- B. NPCI
- C. SBI
- D. Ministry of Finance
✅ Answer: B NACH is operated by NPCI. It is used for bulk payment processing — salary disbursements, EMI collections, insurance premium deductions, utility bill payments.
🏦 Section B — PCI DSS & Card Security Standards
11PCI DSS stands for:
- A. Private Card Identity and Data Security System
- B. Public Card Industry Digital Security Standard
- C. Payment Card Industry Data Security Standard
- D. Protected Card Information and Digital Security Service
✅ Answer: C PCI DSS = Payment Card Industry Data Security Standard. It is the global security framework for protecting cardholder data.
12PCI DSS was established by which group of organizations?
- A. RBI, NPCI, SEBI, IRDAI
- B. Visa, Mastercard, American Express, Discover, JCB
- C. World Bank, IMF, WTO, BIS
- D. ISO, NIST, IEEE, W3C
✅ Answer: B The PCI Security Standards Council was founded by Visa, Mastercard, American Express, Discover Financial Services, and JCB International — the five major card networks.
13How many requirements does PCI DSS have?
- A. 6
- B. 10
- C. 12
- D. 15
✅ Answer: C PCI DSS has 12 core requirements grouped under 6 major goals: Build Secure Network, Protect Cardholder Data, Vulnerability Management, Access Control, Monitor & Test, and Security Policy.
14PCI DSS strictly prohibits the storage of:
- A. Transaction amounts
- B. Merchant names
- C. CVV/CVV2 values after authorization
- D. Transaction timestamps
✅ Answer: C PCI DSS Requirement 3 strictly prohibits storing the CVV (Card Verification Value) after a transaction is authorized. This is one of the most critical PCI DSS rules.
15EMV stands for:
- A. Electronic Money Verification
- C. Europay, Mastercard, Visa
- D. Electronic Mobile Value
✅ Answer: C EMV stands for Europay, Mastercard, and Visa — the three companies that originally developed the chip card standard. EMV chip cards generate a unique code for each transaction, making them resistant to skimming.
🔖 Section C — Tokenization & Encryption
16In payment security, Tokenization means:
- A. Encrypting card data with AES-256
- B. Replacing the card number with a random, meaningless token that cannot be mathematically reversed
- C. Hashing the card number with SHA-256
- D. Storing card numbers in a blockchain
✅ Answer: B Tokenization replaces a card number (like 1234 5678 9876 5432) with a random token (like xk9m2p). Unlike encryption, the token has NO mathematical relationship with the original — only the token vault can map it back.
17RBI made Card-on-File Tokenization mandatory from which date?
- A. January 1, 2021
- B. April 1, 2022
- C. October 1, 2022
- D. January 1, 2023
✅ Answer: C RBI’s CoF (Card-on-File) Tokenization guidelines became effective from October 1, 2022. From that date, merchants are prohibited from storing actual card data on their servers.
18Who generates card tokens in the Card-on-File Tokenization system?
- A. The merchant website
- B. NPCI directly
- C. Card Networks (Visa, Mastercard, RuPay) via Token Service Providers (TSPs)
- D. The customer’s bank only
✅ Answer: C Tokens are generated by card networks (Visa, Mastercard, RuPay) acting as Token Service Providers (TSPs). The merchant receives and stores only the token — never the actual card details.
19What is the key advantage of tokenization over encryption for stored card data?
- A. Tokenization is faster to compute
- B. Tokens can be decrypted by the merchant if needed
- C. Tokens are mathematically irreversible and reduce PCI DSS compliance scope
- D. Tokenization uses smaller file sizes
✅ Answer: C Since tokens have no mathematical link to card data, even if stolen they’re useless. Additionally, tokenization removes card data from merchant systems — drastically reducing their PCI DSS compliance scope.
⚠️ Section D — Payment Fraud & Threats
20Card Skimming at ATMs involves:
- A. Stealing card physically from the holder
- B. Installing a hidden device that copies card data from the magnetic strip
- C. Hacking the bank’s server database
- D. Sending phishing emails to cardholders
✅ Answer: B Skimming devices are attached to ATM card slots or POS terminals to copy magnetic strip data. EMV chip cards greatly reduce this risk as chips generate a unique code per transaction.
21In a UPI fraud involving a “Collect Request,” the victim is tricked into:
- A. Sharing their Aadhaar number
- B. Installing a fake banking app
- C. Entering their UPI PIN to “receive” a refund — which actually debits their account
- D. Clicking on a bank phishing link
✅ Answer: C Fraudsters send a collect/payment request pretending it’s a refund. When the victim enters their UPI PIN to “approve,” money is debited from their account. KEY RULE: You NEVER need UPI PIN to receive money.
22SIM Swapping fraud is used to:
- A. Clone a SIM card physically
- B. Transfer the victim’s phone number to a fraudster’s SIM to intercept OTPs
- C. Install malware on the victim’s phone
- D. Access the victim’s bank app remotely
✅ Answer: B In SIM swap fraud, the attacker convinces the telecom company to transfer the victim’s number to their SIM card. They then receive all OTPs/calls meant for the victim — enabling account takeover.
23CNP (Card Not Present) fraud occurs in which scenario?
- A. When a card is physically stolen and used at an ATM
- B. When stolen card details (number, expiry, CVV) are used for online purchases without the physical card
- C. When a debit card is used at a POS terminal
- D. When a hacker accesses the bank’s core banking system
✅ Answer: B CNP fraud occurs in online/phone transactions where the physical card isn’t presented. The fraudster only needs the card number, expiry date, and CVV. India’s mandatory OTP (AFA) requirement helps prevent CNP fraud.
24Business Email Compromise (BEC) in payment fraud involves:
- A. Sending bulk spam emails to steal card numbers
- B. Impersonating a CEO/CFO via email to trick finance staff into transferring funds
- C. Hacking email servers to read financial statements
- D. Creating fake email login pages for banking
✅ Answer: B BEC involves criminals sending convincing emails impersonating company executives, instructing finance/accounting teams to urgently transfer large amounts to fraudulent accounts. This is a major corporate payment fraud type.
🔧 Section E — Secure Payment Technologies
253D Secure (3DS) technology is used for:
- A. Three-dimensional card design authentication
- B. Adding an extra authentication step (OTP/biometric) during online card transactions
- C. Three layers of network firewall for banks
- D. Three-key symmetric encryption for card data
✅ Answer: B 3D Secure is a protocol that redirects the user to their bank’s authentication page (OTP or biometric) before completing an online card payment. “Verified by Visa” and “Mastercard SecureCode” are 3DS implementations.
26NFC in contactless payments stands for:
- A. National Finance Communication
- B. Near Field Communication
- C. Network Finance Controller
- D. New Frequency Channel
✅ Answer: B NFC = Near Field Communication — a short-range wireless technology (works within ~4cm) used for contactless card payments and mobile payment apps (Google Pay, Apple Pay). Uses tokenization for security.
27An HSM (Hardware Security Module) in banking is used to:
- A. Process millions of transactions simultaneously
- B. Generate OTPs for customers
- C. Securely store and process cryptographic keys in tamper-proof hardware
- D. Monitor network traffic for fraud patterns
✅ Answer: C HSM (Hardware Security Module) is a physical device that generates, stores, and protects cryptographic keys. Keys never leave the HSM in plain text — making key theft extremely difficult even if a server is compromised.
28Why is an EMV chip card more secure than a magnetic strip card?
- A. It stores more data than a magnetic strip
- C. It generates a unique cryptographic code for each transaction — making copied data useless
- D. It has higher magnetic field strength
✅ Answer: C EMV chips generate a unique “dynamic” authentication code (called ARQC) for every transaction. Even if a criminal intercepts this code, it cannot be reused for another transaction — making skimming attacks useless against EMV cards.
29Point-to-Point Encryption (P2PE) in payment systems means:
- A. Encrypting data between two bank servers only
- B. Card data is encrypted from the moment of card swipe/tap until it reaches the secure decryption environment
- C. End-to-end encryption between the customer and merchant only
- D. Encryption using two different algorithms simultaneously
✅ Answer: B P2PE ensures that card data is immediately encrypted at the point of interaction (card reader) and remains encrypted until it reaches the payment processor’s secure environment — the merchant never sees plain card data.
📜 Section F — RBI Guidelines & Laws
30AFA (Additional Factor of Authentication) mandated by RBI for online card transactions means:
- A. Banks must have additional firewall protection
- B. All online card transactions must have a second authentication step (OTP) beyond card details
- C. Cards must have two separate PIN numbers
- D. Banks must store an additional copy of card data
✅ Answer: B AFA = Additional Factor of Authentication. RBI mandates that all card-not-present transactions in India require an OTP or similar second factor — beyond just entering card number + expiry + CVV. This significantly reduces CNP fraud in India.
31Under RBI’s Zero Liability rule (2017), a customer who reports an unauthorized transaction within the prescribed time is entitled to:
- A. 50% refund within 30 days
- B. Full refund within 60 days
- C. Full refund — bank must credit within 10 working days of reporting
- D. Partial refund based on transaction amount
✅ Answer: C RBI’s 2017 circular on Zero Liability states that if an unauthorized transaction occurs due to the bank’s negligence, the customer bears zero liability. The bank must credit the refund within 10 working days of the customer reporting it.
32Positive Pay System introduced by RBI in 2021 applies to:
- A. All digital UPI transactions
- B. ATM withdrawals above ₹1 lakh
- C. Cheque payments above ₹50,000 — requiring prior confirmation from issuer
- D. All NEFT transactions above ₹1 lakh
✅ Answer: C The Positive Pay System requires cheque issuers to pre-confirm details (payee name, amount, date) for cheques of ₹50,000 or more with their bank. This prevents altered/forged cheque fraud.
33RBI’s Data Localisation mandate (2018) for payment data means:
- A. Banks must digitize all paper records
- B. Payment data must be processed only in secure servers
- C. All payment data of Indian customers must be stored only within India
- D. Local banks must process all payments domestically
✅ Answer: C RBI’s 2018 circular mandates that all payment system operators must ensure that data related to Indian payment transactions is stored exclusively in India. Foreign companies like Visa, MasterCard, Amazon Pay must comply.
🌐 Section G — Mixed & High-Priority Questions
34SWIFT is used for:
- A. Processing domestic UPI transactions
- B. India’s domestic card payment network
- C. International interbank financial messaging for cross-border transactions
- D. Biometric payment authentication
✅ Answer: C SWIFT (Society for Worldwide Interbank Financial Telecommunication) is a secure messaging network used by banks worldwide to communicate and settle cross-border transactions. It is headquartered in Belgium.
35CVV/CVV2 printed on cards stands for:
- A. Card Value Verification
- B. Card Verification Value
- C. Certified Virtual Vault
- D. Credit Value Verification
✅ Answer: B CVV = Card Verification Value. It’s the 3-digit code (4-digit on American Express) used to verify that the person making a CNP transaction physically has the card.
36Which authentication method makes TOTP (Time-based OTP) more secure than SMS-based OTP?
- A. TOTP is longer in digits
- B. TOTP is generated locally on the device and doesn’t travel over mobile networks — immune to SIM swap
- C. TOTP requires facial recognition
- D. TOTP is sent through encrypted email
✅ Answer: B TOTP (like Google Authenticator) generates OTPs locally on the device — they never travel via SMS. This makes TOTP immune to SIM swapping attacks that can intercept SMS OTPs.
37BBPS (Bharat Bill Payment System) is used for:
- A. International money transfers
- C. Centralized bill payment for utilities, telecom, insurance, and other billers
- D. Bulk salary disbursements
✅ Answer: C BBPS (operated by NPCI) is an integrated bill payment system that allows customers to pay electricity, water, gas, telecom, insurance, loan EMIs, and other bills through any channel (bank, app, agent).
38What is FASTag used for?
- A. Fast UPI transactions above ₹1 lakh
- B. RFID-based automatic electronic toll collection on national highways
- C. Fast-track ATM withdrawals
- D. Quick credit card bill payment
✅ Answer: B FASTag is an RFID (Radio Frequency Identification) sticker fixed on vehicles that enables automatic electronic toll deduction at National Highway toll plazas without stopping. It’s linked to a prepaid wallet or bank account.
39Two-Factor Authentication (2FA) in UPI consists of:
- A. Card number + CVV
- B. Device binding (registered mobile) + UPI PIN
- C. Username + Password
- D. Aadhaar number + OTP only
✅ Answer: B UPI’s 2FA is: 1) Device Binding — the UPI is registered and bound to a specific mobile device/SIM (something you have), and 2) UPI PIN — a 4 or 6-digit PIN (something you know).
40Which of the following is NOT operated by NPCI?
- A. UPI
- B. RuPay
- C. NEFT
- D. IMPS
✅ Answer: C NEFT (National Electronic Funds Transfer) is operated by RBI — not NPCI. UPI, RuPay, IMPS, NACH, AEPS, BBPS, and FASTag are all operated by NPCI.
41A merchant compliant with PCI DSS must do which of the following?
- A. Store all customer card data for fraud investigation
- B. Share card data with third parties for analytics
- C. Use tokenization or encryption to protect stored card data, and never store CVV
- D. Keep card data on unencrypted spreadsheets for easy access
✅ Answer: C PCI DSS requires merchants to protect stored cardholder data (via tokenization/encryption, masking PAN) and NEVER store CVV/CVV2 after authorization under any circumstances.
42What does IMPS stand for?
- A. Internet Mobile Payment Service
- B. Immediate Payment Service
- C. Instant Mobile Payment System
- D. Integrated Mobile Payment Service
✅ Answer: B IMPS = Immediate Payment Service. It enables 24×7 instant interbank fund transfers up to ₹5 lakh per transaction. It was the foundation on which UPI was built.
43In AI-based payment fraud detection, which behavioral pattern might trigger a suspicious flag?
- A. Regular monthly salary credit
- B. EMI deduction on the same date every month
- C. Multiple high-value transactions in different countries within minutes of each other
- D. Grocery purchases at the same supermarket each week
✅ Answer: C AI fraud detection systems flag anomalous behavior — like transactions in two different countries within minutes (geographically impossible). Machine learning models build a behavioral baseline and alert when it’s violated.
44E-wallets like Paytm, PhonePe, and Google Pay are regulated in India by:
- A. SEBI
- B. NPCI only
- C. RBI (under Payment Aggregators/Payment Gateways guidelines)
- D. Ministry of Finance directly
✅ Answer: C RBI regulates payment aggregators and payment gateways in India. Companies operating e-wallets or payment services must obtain authorization from RBI and comply with its guidelines.
45Which type of card fraud involves a very thin insert placed inside an ATM card slot to read chip card data?
- A. Phishing
- B. Card Skimming
- C. Shimming
- D. Vishing
✅ Answer: C Shimming is an evolution of skimming that targets chip cards. A paper-thin device (“shim”) is inserted into the card slot that can read chip card data — though this provides less useful data than magnetic strip skimming.
46NACH (National Automated Clearing House) is primarily used for:
- A. International fund transfers
- B. One-time UPI payments
- C. Bulk and recurring transactions like salary payments, EMI deductions, and subsidy disbursements
- D. High-value real-time settlements
✅ Answer: C NACH processes large volumes of recurring transactions in batches — like monthly salary disbursements to thousands of employees, EMI deductions, insurance premiums, pension payments, and government subsidies.
47The “Collect” feature in UPI can be misused in fraud when:
- A. The receiver sends money to the wrong UPI ID
- B. A fraudster sends a collect request pretending it is a refund/prize, and the victim enters their PIN to approve it
- C. The UPI app fails to connect to the bank server
- D. Two users try to pay simultaneously
✅ Answer: B UPI Collect requests are legitimate features but exploited by fraudsters. They send requests saying “enter PIN to receive ₹5000 refund” — but entering PIN on a collect request DEBITS (sends) money. Awareness is the key defense.
48Aadhaar Pay uses which combination for authentication?
- A. Aadhaar OTP + Bank PIN
- B. Aadhaar Number + Biometric (fingerprint/iris)
- C. Aadhaar + Debit Card number
- D. Mobile number + OTP only
✅ Answer: B Aadhaar Pay (part of AEPS) allows merchants to accept payments by authenticating customers using their Aadhaar number + biometric (fingerprint or iris scan). No bank card or mobile phone needed by the customer.
49Which of the following is true about RTGS?
- A. RTGS is operated by NPCI and used for small retail transactions
- B. RTGS has no minimum transaction amount
- C. RTGS is operated by RBI, settles transactions individually in real-time with minimum ₹2 lakh
- D. RTGS works only during banking hours on weekdays
✅ Answer: C RTGS is operated by RBI, available 24×7 (since December 2020), processes transactions individually in real-time, and has a minimum transaction of ₹2 lakh. It is used for large-value, time-critical transactions.
50Which government initiative promoted the use of digital payments and financial inclusion in India?
- A. Digital Locker Scheme
- B. Pradhan Mantri Jan Dhan Yojana (PMJDY) + Digital India
- C. UIDAI Aadhaar only
- D. Make in India
✅ Answer: B PMJDY (launched August 28, 2014) provided bank accounts to millions of unbanked Indians, coupled with RuPay debit cards. Combined with Digital India, it massively expanded financial and digital payment inclusion across India.
51Which cybercrime helpline number should you call if you lose money in online banking fraud in India?
- A. 112
- B. 100
- C. 1930
- D. 155260
✅ Answer: C 1930 is the national cybercrime helpline. Victims of online financial fraud should immediately call 1930 or report at cybercrime.gov.in. Quick reporting increases chances of recovering funds.
52The maximum transaction limit per UPI transaction is currently:
- A. ₹50,000
- B. ₹1 lakh (₹2 lakh for specific verified transactions)
- C. ₹5 lakh
- D. ₹25,000
✅ Answer: B Standard UPI limit is ₹1 lakh per transaction. For specific categories like IPO subscriptions, insurance, medical emergencies, and verified merchant categories, NPCI allows up to ₹2 lakh per transaction.