to prevent the governments digital payments push getting hit by efraud the reserve bank of india has immediately taken 3 risk reduction measures it has ordered all prepaid payment instrument issuers rbi authorised banks and nbfcs to get a special audit done of their systems by empanelled auditors of indian computer emergency response team certin on a priority basis and immediately comply with the audit report recommendations ppis have also been directed to take appropriate measures to mitigate phishing attacks considering that given the digital push a large number of users are likely to be first time users of the digital channels ppis have been instructed to take additional safety measures depending on risk perception or threats as they emerge to ensure that its directive is followed rbi has asked ppis to send a confirmation giving the details of action plan including the name and date of appointment of the auditor may please be conveyed to department of payment and settlement system by december 21 2016 also read your atm could be running on expired security software the rbi notification issued on december 9 on security and risk mitigation measures technical audit of prepaid payment instrument issuers clearly highlights the central banks concern that the governments effort to make people move towards cashless means of payment does not hit a roadblock the notification says that with the demonetisation of the earlier rs 500 and rs 1000 notes the use of alternate modes of payment specifically ewallets has gained momentum while all efforts should continue to be made by entities ppis for onboarding new customers and merchants it needs to be borne in mind that any kind of cyber security incident affecting the digital channelsproducts particularly at this juncture may have significant systemwide ramifications and act as a dampener for the adoption of digital products by public at large it adds the notification further says as the rapid escalation in epayments may put significant pressure on the existing digital infrastructure it is imperative that the integrity of our digital ecosystem is maintained by ensuring that they remain robust and fully secure the notification draws attention to the existing guidelines requiring authorised entities to submit system audit reports from a cisadisa qualified auditor on an annual basis the scope of this system audit includes evaluation of the hardware structure operating systems and critical applications security and controls in place including access controls on key applications disaster recovery plans training of personnel managing the systems and applications documentation etc in view of this all authorised entitiesbanks issuing ppis in the country have been advised to conduct a special audit by auditors of indian computer emergency response team certin on a priority basis the audit should cover compliance as per security best practices specifically the application security lifecycle and patchvulnerability and change management aspects for the system authorised and adherence to the process flow approved by the reserve bank prepaid payment instruments are payment instruments that facilitate purchase of goods and services including