FASTag money stealing scam debunked by NPCI: Here’s why your FASTag money is safe

FASTag has changed the way India moves. However, a new video doing the rounds on the internet is creating suspicion in the minds of FASTag users. The video shows a boy cleaning car windshields swiping his smartwatch on the tag to steal money from the tag. One FASTag user took to social media channels asking concerned authorities about this alleged scam. The National Payment Corporation of India (NPCI) has come forward with a fact-check calling the video “baseless and false”.

In order to stop the further spread of this fake video, NPCI has taken the step to remove it from social media platforms. The payment authority has also released a statement clarifying why such a scam cannot happen with FASTags.

The primary reason why such an incident may not happen is that the FASTag payment involves a total of four different parties. This includes NPCI, Acquirer Bank, Issuer Bank and Toll Plazas. It won’t be possible for an individual entity to by any one of them to extract payment from a FASTag. NPCI ensure that there are many layers of security in between which are placed for safety of transactions.

Here are some of the assurances, provided by NPCI in a recent statement:

1. NETC FASTag operates only for Person to Merchant (P2M) transactions. No Person to Person (P2P) transactions is facilitated through NETC FASTag Network. This means an individual cannot receive the money in NETC FASTag ecosystem from fraudulent transactions. Only authorised System Integrators (SI), on behalf of concessionaires are allowed to participate for specific plazas and initiate Payment transactions.

2. The infrastructure deployed between SI system/Concessionaire and Banks are secured by whitelisting only permitted IP Addresses and URLS. The hardware installed at the Toll Plaza data centre/server room are cryptographically secured through Hardware Security Module (HSM).

3. Further, acquiring banks are connected to NPCI for interoperable NETC FASTag linked payments for which NPCI switch is connected with Acquirer & Issuer Banks through secure NPCHNET connectivity. The IPs of Banks are whitelisted at NPCI end and similarly, NPCI IPs are whitelisted at the Banks end to facilitate the API connectivity between NPCI & Banks.

4. Every API call needs to pass through a secure Firewall. Every time the Bank connects with NPCI through API connectivity, the data is encrypted with a secure 256 SHA ECC algorithm and locked with a Hexadecimal Private Key. Only NPCI possessing the corresponding Public key will be able to access the information by decryption.

FASTag was first used in the year 2015 and since then the ecosystem has been expanding multifold. In 2019, Fastag was made mandatory for National Highway tolls. The electronic toll collection method uses RFID to process the payment.

The post FASTag money stealing scam debunked by NPCI: Here’s why your FASTag money is safe appeared first on BGR India.