Business Sense

With Nigeria gradually transiting from cash to an electronic based economy, by virtue of the implementation of the Central Bank of Nigeria’s (CBN) cashless policy, cyber criminals and hackers in the country, who hitherto attacked businesses and individuals across the Atlantic, are redirecting their energies towards exploiting possible loopholes in the electronic payment system in order to perpetuate fraud.

Analysts have warned financial institutions and other stakeholders in the electronic payment industry to step up investments in security of electronic transactions, or risk being overwhelmed by the spate of sophisticated cyber attacks that would soon arise as a result of the sheer volume of financial transactions online.

Industry experts have said that the success of CBN’s Cash less initiative would be largely dependent on security.

To further buttress analyst’s fears, Nigeria, according to the latest Symantec Internet Security Threat Report, has moved six positions up the ladder to occupy the 59th position globally among countries with greatest Internet Security threat. Analysts have expressed concerns about Nigeria’s rising cybercrime profile, even as there is little effort from government to pass into law, pending bills aimed at criminalising the acts.

The analysts further identified this situation as a major drawback to the development of e-payments in Nigeria. According to them, many Nigerians may lose confidence in the system and CBN’s objective of drastically reducing the cost of managing cash in the economy will certainly be defeated. The lack of confidence in Nigeria’s e-payment system could hinder foreign investments.

Analysts say it could send negative signals to the global business community that Nigeria is an unserious and unsecure entity to do business with in international trade. Peter Boglo of Oracle Corporation opined that Nigeria’s cashless initiative would bring with it an explosion of data running on electronic platforms, urging banks to take advantage of latest security solutions to protect their networks.

“With the new shift in the economy, where emphasis is being placed on electronic transactions, being championed by the CBN through its cash less initiative, banks would be highly susceptible to cyber attacks and threats,” he noted.

The apex bank had envisaged this security challenge as it encouraged the country to migrate into a cash less mode, and accordingly, directed all players in the banking and electronic payment sector to attain Payment Card Industry Data Security Standard (PCIDSS) compliance to ensure that card users in the country would continue to experience enhanced payment data security.

Up till now, out of the 21 financial institutions currently operating in the country, only Access Bank Plc has achieved compliance, Business Day reveals. It was gathered that Interswitch, ValuCard and only E-Transact PLC have achieved compliance.

Informed sources told Business Day, that banks are investing less resource in PCIDSS efforts because they think implementing these policies will disrupt business operations. Security experts told Business Day that PCIDSS certification represents a common set of security best practice that, if strictly adhered to, will ensure the safe and secure handling of payment card data and transactions.

The requirements, according to them ensure that the entities that process, store or transmit cardholders’ data meet and adhere to the following standards: maintain a secure network for processing transactions; protection of cardholders and transaction data while in transit or at rest on the network; regular monitoring and testing of Information Technology (IT) networks and infrastructure among others.

Mitchell Elegbe, chief executive officer and Managing director of Interswitch Nigeria Limited told Business Day, in an interview, that financial institutions, NIBBS and other stakeholders in the industry are all making investments in PCIDSS certification. But analysts argue that they are doing it at a slow pace.

“PCIDSS is so important because it ensures data security. In switching, data security is a critical part. You know, millions of transactions take place daily. What guarantees the success to those transactions is the security put in place to protect the data (password, cardholder KYC, etc) of users. Besides this importance, PCIDSS is a global best practice adopted by Visa, MasterCard, China UnionPay etc to protect information entrusted to the system by card users”, he added.

Rasaq Olaegbe, an expert in electronic payments told Business Day that criminal-minded individuals are coming up with advanced means of defrauding card users and card holders. He also pointed out that stakeholders in the industry are coming up with indigenous ways to beat the fraudsters.

“Now, the PCIDSS is compelling. Why? CBN has launched the cash less policy, which means we are seeing the end of overtly dependence on cash transaction and more of cards. So, to encourage millions of local card users and foreigners (European, Asians, Africans) who have come to rely on the safety of the system (ATM, PoS, mobile, Internet) in their home countries, we must follow this global practice.

“If we do not apply the PCIDSS certification, PCISSC (that is the organisation behind data security, education and awareness of the PCIDSS involving American Express, Discover Financial Services, JCB International, MasterCard Worldwide and Visa Inc) would not consider Nigeria as a serious organisation to do business with in international trade,” Olaegbe hinted.

He noted that PCIDSS is a rigorous process but it is all to ensure compliance to global data security procedure.

“At this stage we are now, Nigeria cannot afford not to invest in PCIDSS. Granted no system is foolproof, but not doing it means you are opening the doors for thieves. You know, because you have embedded security measure in your saloon car  does not mean you should leave your car engine running or leave the key in the glove compartment. PCIDSS is a safety measure. It protects cardholders and builds confidence in the system”, he enthused.

However, experts believe the cashless initiative offers a great opportunity for indigenous Information Technology (IT) companies to develop local content capacity and benefit from the initiative. Beyond this, the envisaged security challenge provides ample opportunity for local software developers and entrepreneurs to rise up to the challenge and build software solutions that can protect electronic transactions, improved functionality, security ease of use and interoperability. There is an imperative to increase local content in software and ensure that we develop the right skills mix in the jobs being created. The Nigerian IT industry should seize the current opportunities to transform itself into a global force”, he concluded.

Culled from: businessdayonline.com