Market regulator Sebi proposes to beef up trading account security

Suggests a SIM binding framework to prevent unauthorised access to demat and trading accounts

The Securities and Exchange Board of India (Sebi) has proposed a SIM binding mechanism to prevent unauthorised access to trading and demat accounts, similar to the security measures used in Unified Payments Interface (UPI) payments. This mechanism aims to ensure that a unique client code (UCC) can only be accessed by the device linked to the SIM, mirroring the security protocols used by UPI apps.

 

Under this proposal, traders will be able to log in to their accounts only when the trading app recognises the UCC along with the SIM and the mobile device. This mechanism will create a secure and robust authentication process for logging into mobile trading apps, allowing investors to monitor all logged-in sessions on other devices.

 

Similar to UPI-based payments, trading apps will recognise the UCC, SIM, and mobile device details, ensuring that only authorised devices can access the account.

 

Biometric authentication will be required on the primary SIM and device for added security.

 

A QR code-based, proximity-sensitive, and time-sensitive authentication will be used for logging into other devices such as desktops and laptops. This is similar to the multiple login facilities provided by many social media platforms.

 

Sebi has included a fallback mechanism to handle situations where the primary device is lost or changed, ensuring continuous access to the account.

 

One mobile device can be linked to multiple UCCs of family members who use the same number, provided they are authorised.

 

The framework is proposed to be initially applicable to the top 10 large brokers and then extended to all stock brokers in a phased manner. Investors will have the option to opt for this authentication mechanism, providing them with enhanced security measures.

 

Sebi’s proposal comes in response to instances of unauthorised access or modifications in trading accounts, SIM spoofing, erroneous share transfers, and other security concerns. The regulator aims to address these issues by introducing a more secure authentication process.