The extra layer of security added by interswitch in the form of One Time Pin (OTP) is sure an overkill.

A regular ATM card requires the physical card, and the pin for cash withdrawals to take place.
Making payments online when buying goods and services require
1. The 16 digits, expiry date of card and CVV2 to confirm that you have access to the physical card.
2. To further confirm you are indeed an authorized user of the card, you are required to type in your 4 digit pin like you would when using the physical ATM

The introduction of the use of token does not make the gateway any more secure but discourages customers.
I believe if anyone has access to your card, your PIN, they sure can have access to your token.

let me give some scenarios.

1. Kidnap. -A kidnapper can easily escort you to an ATM and there you wont need the token to lose cash
2. Unfaithful partner - A partner can swap your token with his/hers and be in possession of it for days without you knowing,
everytime you try using it, you get invalid entry error.
3. Theft - You card being stolen does not have your pin printed on it so it is still safe as they require your pin to pay through interswitch website

So can someone tell me how token use adds extra security to online purchase?

This is because i noticed a huge sales decline and abandoned carts on many websites of my clients. These guys have invested 75k to 150k just to be integrated, only for interswitch to implement strategies that will discourage buyers.


3 months before the OTP went live on Quickteller.com (a property of interswitch), all merchant's websites had OTP enabled,
so when buyers call, you are force to redirect buyers to use quickteller.com directly as payment goes smoothly there.
was this an indirect attempt to promote quickteller.com?


what do you guys think?

I think Interswitch is trying to patch a leaking roof by adding layers and layers of seals rather than deciding to face the problem head-on and change the roofing sheet. The problem of credit/debit card fraud is not one they are presently able to handle effectively.

Amen brother. It might make a little safer but at the terrible expense of user experience.

Plus all these added layers just increases the chance of more transaction failures.