NPCI Stops Onboarding Truecaller Users on UPI After Data Breach
The National Payments Corporation of India (NPCI), in a letter to the Internet Freedom Foundation, stated that it has stopped onboarding new Truecaller users on its UPI platforms.
“We wish to reiterate that no sooner the bug was noticed on 30 July 2019, NPCI has stopped Truecaller new user onboarding services on UPI platform,” wrote Dilip Asbe, NPCI Managing Director and CEO.
A bug in caller-ID app Truecaller risked its users’ financial data on Tuesday, 30 July. The app, which helps people avoid spam callers, started registering users to the Unified Payment Interface (UPI) account without their permission.
Truecaller’s payment service works in India through its payments partner, ICICI Bank, which facilitates UPI service for the platform.
The bug in Truecaller became active when one downloaded the app’s 10.41.6 update.
IFF, in a statement issued on Wednesday, said: “This is not only about Truecaller. It is about user consent more widely. The privacy, safety and security of users on the UPI interface.”
“While for a complete remedy, we need a data protection law (which India does not have yet) that is user centric (like the Indian Privacy Code), we appreciate and commend the actions being taken by NPCI within its mandate and urge it do more,” it added
Truecaller had released a statement confirming the presence of the bug. The company will be releasing a new version of the app with a fix. It told The Quint:
(The Quint is now available on Telegram. For handpicked stories every day, subscribe to us on Telegram)