Security Measures

[Shravan_B_K]

Hi Krishna,

@Krishna_Chaitanya_K

The password reset process is too simple IMO. I understand that gaining access to someone’s PAN, SMS, or email is difficult,

The password reset flow that is being used is a robust one, and we haven’t come across cases where someone has lost access to their account because the flow is simple. PAN number, email ID, and mobile number are personal to a certain individual, and the chances of a third party having access to all of these or either of these is very low. We also send an email and a mobile app push notification to alert the user of a password change.

@Krishna_Chaitanya_K

This isn’t like banking, where there are daily withdrawal limits or delays in activating a new payee.

The money and securities can only be moved to the user’s bank account and Demat account, respectively, and can’t be moved to any fraudster’s account.

Further,

@Shravan_B_K

Also as I previously said, the cases of hacking have come down to zero post the implementation of 2FA regulations since Sept 2022. Since modern emails service providers have implemented 2FA mandatorily, the probability of hack is also very less.

@Shravan_B_K

Further, we have also introduced a feature that allows the user to block his account. This ensures that if the user reports loss of mobile/ loss of access to email, the account will be blocked immediately, and the account reset flow involves mandatorily doing a re-KYC, thus ensuring a tougher reset flow . I hope this addresses the concerns raised.

Having said that, we’ll certainly look into what can be done better here, but as of now, this is a robust process that has stood the test of time.