Study of RUPAY Purchase Transaction Report of Work done at IDRBT during Summer Internship – 2018 By- Itishree Nayak, B.Tech, 4th year, IT IIIT Bhubaneswar, Bhubaneswar Under the Guidance of Dr. N. V. Narendra Kumar CERTIFICATE This is to certify that the summer internship project report entitled “Study of RuPay Purchase Transaction” submitted to Institute for Development and Research in Banking Technology (IDRBT), Hyderabad is a bonafide record of work done by Itishree Nayak, B.Tech (IT), IIIT Bhubaneswar, Bhubaneswar from 10-05-2018 to 03-07- 2018 under my supervision. Project Guide Dr. N. V. Narendra Kumar Asst. Professor IDRBT, Hyderabad CONTENTS ACKNOWLEDGMENT ABSTRACT 1. INTRODUCTION...…………………………………6 1.1. Objective of RuPay 1.2. Structure of the Report 2. RUPAY.………………………………...……………9 2.1. Advantages of RuPay Card 2.2. Features of RuPay Card 3. NPCI………………………………………………..12 3.1. Role of NPCI 4. ECOSYSTEM OF RUPAY………………………...14 4.1. Participants in the RuPay Transaction 4.2. Roles and Responsibilities of Participants 4.3. Transaction Flow 4.3.1. Iframe Flow 4.3.2. Redirection Flow 4.4. API Specifications 5. SECURITY SCENARIOS………………………….42 6. CONCLUSION……………………………………..47 REFERENCES ACKNOWLEDGMENT Behind every achievement lies an unfathomable sea of gratitude to those who activated it, without whom it would ever have come into existence. To them, I lay the words of gratitude imprinted with me. I would like to thank IDRBT for giving an opportunity and the necessary facilities and also the staff of admin and library for their support. I would thank my guide Dr. N. V. Narendra Kumar, for his timely valuable guidance and suggestions for this report. I would like to thank all who have been inspiring guides and committed caretakers and who have given me the moral support in every situation of my internship career. This encouragement and support by them, especially in carrying out this report motivated me to complete this study. My sincere thanks to, IIIT Bhubaneswar and also my friends who encouraged me to pursue this internship. ABSTRACT This report studies RuPay, an effort to promote the cause of financial inclusion in the country, launched a few years back. RuPay is Indian’s own domestic payment network developed on the lines of international payment networks like Visa, MasterCard, Discover etc. In a market that has been dominated thus far by international card payment networks, the RuPay card has been gaining much popularity lately. The main advantage of RuPay cards is that they are flexible with product platforms. Affordable lower cost faster transaction, customized product offering, protection of information are some of its benefits. We have studied some of the transactions permitted by RuPay with the objective of analyzing protocol level security aspects and identified potential scenarios. Further technical analysis is needed to ensure that the RuPay network is secure against these scenarios. Such an analysis requires detailed information about the implementation. Keywords: RuPay, NPCI, API, Security. 1. INTRODUCTION “RuPay”, the word itself has a sense of nationality in it. “RuPay” has been coined from 2 words, which are Rupee and Payment. RuPay is the first-of-its-kind domestic Debit and Credit Card payment network of India, with wide acceptance at ATMs, POS devices and e-commerce websites across India. It is a highly secure network that protects against anti-phishing. It is our answer to international payment networks, expressing pride over our nationality. RuPay fulfills RBI’s vision of initiating a ‘less cash’ economy. This could be achieved only by encouraging every Indian bank and financial institute to become tech-savvy and engage in offering electronic payments. 1.1. Objective of RuPay RuPay, a new card payment scheme launched by the National Payments Corporation of India (NPCI), has been conceived to fulfill RBI’s vision to offer a domestic, open- loop, multilateral system which will allow all Indian banks and financial institutions in India to participate in electronic payments. Few of its objectives are as follows. The vision of NPCI being able to provide citizens of our country anytime, anywhere payment services which are simple, easy to use, safe, and secure, fast and also cost- effective. NPCI aims to operate for the benefit of all the member banks and the common man at large. The core objective was to consolidate and integrate the multiple systems with varying service levels into nation-wide uniform and standard business process for all retail payment systems. This led to the formation of National Payments Corporation of India, (NPCI). 1.2. Structure of the Report This particular report studies the following concepts 1. In section 2 we study about RuPay, its advantages, benefits, and applications of RuPay. 2. In section 3 we study the role of NPCI and its involvement in the RuPay. 3. In section 4 we study about the different transaction types, transacting parties, transaction flow and the API’s involved in the transaction. 4. Section 5 talks about the potential scenarios in which the system can fail. 5. Section 6 concludes the report. 2. RUPAY RuPay is an Indian domestic card scheme conceived and launched by the National Payments Corporation of India (NPCI) on 26 March 2012, the umbrella organization that powers retail payments in the country. The provision under the Payment and Settlement Systems Act, 2007, empowered the Reserve Bank of India (RBI) and the Indian Banks’ Association (IBA) to create a secure electronic payment and settlement system in India. RuPay Cards are accepted at 97% of all PoS terminals in India. RuPay has partnered 39 PoS Acquiring Banks in India to accept their cards at PoS terminals located at different merchant locations. The nature of NPCI’s initiatives and objectives includes it under the “Not for Profit Company” under the provisions of Section 25 of the Companies Act 1956 and more recently under the Section 8 of the Companies Act 2013. This was an initiative to build the necessary banking infrastructure required to propel India towards a ‘less cash’ economy. NPCI recognizes the need for tech-driven innovations in the retail payments system to drive operational efficiencies among a larger Indian audience. 2.1. Advantages of RuPay Card The Indian market offers huge potential for cards penetration despite the challenges. RuPay Cards will address the needs of the Indian consumers, merchants, and banks. The benefits of RuPay debit card are the flexibility of the product platform, high levels of acceptance and the strength of the RuPay brand-all of which will contribute to an increased product experience 1. Lower cost and affordability: Since the transaction processing will happen domestically, it would lead to lower cost of clearing and settlement for each transaction. This will make the transaction cost affordable and will drive usage of cards in the industry. 2. Customized product offering: Customized product offering: RuPay, being a domestic scheme is committed towards the development of customized product and service offerings for Indian consumers. 3. Provide electronic product options to untapped/ unexplored consumer segment: There are under- penetrated/untapped consumers segments in rural areas that do not have access to banking and financial services. Right pricing of RuPay products would make the RuPay cards more economically feasible for banks to offer to their customers. In addition, relevant product variants would ensure that banks can target the hitherto untapped consumer segments. 4. Inter-operability between payment channels and products: RuPay card is uniquely positioned to offer complete inter-operability between various payments channels and products. NPCI currently offers varied solutions across platforms including ATMs, mobile technology, cheques etc and is extremely well placed in nurturing RuPay cards across these platforms. 2.2. Features of RuPay Card 1. Complimentary Lounge Access Program – Domestic & International 2. 24X7 Concierge Services 3. Earn Cashback time after time 4. Comprehensive Insurance Cover 5. Exclusive Merchant Offers 3. NPCI National Payments Corporation of India (NPCI), an umbrella organization for operating retail payments and settlement systems in India, is an initiative of Reserve Bank of India (RBI) and Indian Banks’ Association (IBA) under the provisions of the Payment and Settlement Systems Act, 2007, for creating a robust Payment & Settlement Infrastructure in India. The ten core promoter banks are State Bank of India, Punjab National Bank, Canara Bank, Bank of Baroda, and Union Bank of India, Bank of India, ICICI Bank, HDFC Bank, Citibank N. A., and HSBC. In 2016 the shareholding was broad-based to 56 member banks to include more banks representing all sectors. 3.1. Role of NPCI As a part of the RuPay Switching Service, 1. The ‘NPCI Network’ will collect transactions from a trusted source (an acquirer) and deliver it to a trusted destination (an issuer). 2. The trusted destination will use this information to validate the transaction to the cardholder’s account and further authenticate the transaction back to the trusted source through ‘NPCI Network’. 3. ‘NPCI Network’ further facilitates the process of clearing a valid authenticated transaction and provides the settlement service. 4. A settlement service is a facility within which funds are exchanged between members and NPCI to settle transactions and fee amounts. 5. The RuPay Switching Service will facilitate POS and ATM transactions among all member banks participating in the ‘NPCI network’. 6. It supports both single message system (SMS) and dual Messaging Systems (DMS). Transaction flow for SMS and DMS are described below. 7. The RuPay Switching Service operates on a continuous basis, ensuring that cardholders in India can use their card anytime and that Acquirers and Issuers in India always have access to NPCI RuPay Switch. 4. ECOSYSTEM OF RUPAY 4.1. Participants of RuPay Transaction The RuPay e-Commerce architecture involves the following constituents: 4.1.1. Cardholder: Cardholder means any customer in possession of a payment card (RuPay Debit cards and Credit Cards) 4.1.2.