BoB boosting app sign-ups with fake numbers?
A whistleblower brings this issue before the media; However, Bank of Baroda denies reports that stated that it linked mobile numbers of strangers to boost app registration
image for illustrative purpose
Mumbai Bank of Baroda (BoB), the second-largest state-run lender, is alleged to have linked mobile numbers of strangers to boost app registrations, compromising on security factor. However, the bank’s spokesperson has denied it. The bank’s spokesperson replied to Bizz Buzz, insisting that one mobile number can be linked with only one BoB World account.
A Whistleblower, who is on the bank’s payroll and hence his identity can’t be revealed, has brought this issue before the media.
He and his colleagues learnt of a workaround from peers in other branches: fetch the list of bank accounts not linked to mobile numbers, link these accounts to any mobile numbers they could gather - of bank staffers, sanitation and security workers and their relatives - to generate the one-time password (OTP) needed to join the app, and sign up these accounts from the backend. As per their modus operandi, the employees would then deregister these customers from the app and reuse the same mobile number in the same manner with other bank accounts, reveals media reports.
When the nodal officer from the regional office – one officer was deputed at each branch to ensure the success of the task – was told about the tactic, he offered his as well as his wife’s mobile numbers to link with customers’ bank accounts, it is said.
In one of his subsequent emails – sent between March and June of last year to the Managing Director and Chief Executive Officer as well as Executive Directors – the retired executive wrote that he visited a few branches in his city and suggested that he learned that the staff at these branches were not only adding their own mobile numbers to customers’ accounts, but also buying new SIM cards to inflate the number of registrations of BoB World. One of his emails says that internal inspection reports of some branches have even made a note of these shenanigans.
Even though many customers were deregistered right after they were signed up – meaning using these practices to sign them up did not automatically lead to an increase in the number of active users of the app – it did boost the number of downloads and the number of sign-ups. These metrics are also cited to gauge an app’s success.
The safety of tens of thousands of bank accounts was reportedly at risk since they were linked with strangers’ mobile numbers.
A cleanup is said to be underway and will take place in stages. First, the phone numbers that were illegally linked to a maximum number of accounts - 100 or more - had to be de-linked. This was followed by mobile numbers linked with 50-plus accounts and later those with 30 or more accounts.
When contacted by Bizz Buzz, a spokesperson from Bank of Baroda said: “The bank has a robust system with the necessary controls in place and we reaffirm our commitment to customer security.”
The bank reiterates that a fully system authenticated and customer consent-based process has been and is currently being followed for undertaking any mobile banking app registrations in the bank. The bank has a current mobile banking activated user base of three crore customers, all of whom are linked to a unique mobile number seeded with their bank account.
In order to spread the benefits of digital banking amongst its customer base and increase digital penetration, the bank has increased the mobile banking user base. This increase is on the back of robust system controls, which does not allow multiple mobile app users on a single mobile number. Security and privacy are the core design features of the bank’s digital platforms and the bank accords them the topmost importance, the spokesperson said.
Hence, the point raised on using unauthenticated, stranger’s or non-customer mobile numbers for boosting app registrations is not factually correct as one mobile number can be counted with only one mobile app at any point in time, the spokesperson added.
The bank targets only active users who can get onboarded only through the system controls in place, rather than mobile app downloads or registrations. The three crore customers on our mobile banking app are users with active banking engagements and transactions on the app, he added.
