Answer: D. Actual card details. Tokenisation substitutes an alternate code for actual card details in supported transactions.
How does tokenisation help at checkout?
A Guarantees every refund
B Hides actual card details
C Removes payment authorisation
D Cancels the physical card
Answer: B. Hides actual card details. A tokenised transaction can keep the actual card details from being shared with the merchant.
Which parties define a card token?
A Merchant, address, PIN
B Account, bill, payment
C Card, requestor, device
D Card, bank, currency
Answer: C. Card, requestor, device. RBI describes device-based tokens as unique to a card, token requestor, and identified device.
Who should receive your transaction OTP?
A A verified courier
B A caller claiming bank
C A social media contact
D No one else
Answer: D. No one else. Do not disclose an OTP to callers or messages; enter it only in a transaction you initiated through a trusted channel.
Which message is a common phishing clue?
A Monthly statement in app
B Known merchant receipt
C Unexpected urgent payment link
D Card limit shown securely
Answer: C. Unexpected urgent payment link. Urgent messages urging you to follow an unexpected payment link are a common phishing tactic.
What should you do if a caller asks for CVV?
A End the call
B Share it after verification
C Send a card photo
D Read it slowly
Answer: A. End the call. A caller should not need your CVV; end the call and contact the issuer through an official number.
What is the safest first action after spotting an unauthorised card charge?
A Contact issuer immediately
B Wait for next statement
C Reply to the SMS
D Post card details online
Answer: A. Contact issuer immediately. Notify the issuer promptly through its official channel, block the card if needed, and retain the complaint acknowledgement.
Under RBI rules, when can a third-party breach give a customer zero liability?
A Report within three months
B Report after the annual fee
C Report within three working days
D Only after a police order
Answer: C. Report within three working days. For a qualifying third-party breach, RBI rules provide zero liability when the customer reports within three working days of receiving the bank’s transaction communication.
If a qualifying unauthorised transaction is reported after three days, what matters next?
A Reward points balance
B Applicable RBI liability rules
C Merchant rating
D The card colour
Answer: B. Applicable RBI liability rules. For reports beyond the first three working days, the applicable RBI framework and the bank’s stated policy determine liability; exact treatment depends on the case.
What should happen immediately after a card goes missing?
A Block it with issuer
B Share its number publicly
C Keep using its wallet token
D Wait for a charge
Answer: A. Block it with issuer. Contact the issuer using a verified channel to block or temporarily lock the card and report the loss.
Why use card controls for channels you do not need?
A Avoid statement delivery
B Change the billing cycle
C Reduce unwanted exposure
D Increase the credit limit
Answer: C. Reduce unwanted exposure. Switching off unused transaction channels or setting suitable limits can reduce exposure; issuer controls and availability vary.
What is an additional factor of authentication meant to do?
A Guarantee a refund
B Replace the card account
C Waive transaction fees
D Add a verification step
Answer: D. Add a verification step. An additional factor adds a check, such as an OTP, to help authenticate a transaction.
Which checkout method can avoid sharing the actual card number with a merchant?
A A supported tokenised payment
B A texted card number
C A copied card image
D A public spreadsheet
Answer: A. A supported tokenised payment. A properly supported tokenised payment uses an alternate code instead of exposing the actual card details to the merchant.
Why should you protect the CVV even when a card is in your wallet?
A It can support remote payments
B It blocks ATM withdrawals
C It sets your billing date
D It reveals your credit score
Answer: A. It can support remote payments. Card details including CVV can be misused in certain remote transactions, so keep them private.
What security benefit can an EMV chip provide?
A Dynamic transaction data
B Identity verification at every shop
C Unlimited purchase protection
D Automatic charge reversal
Answer: A. Dynamic transaction data. Chip transactions can use transaction-specific cryptographic data, making simple copied magnetic-stripe data less useful.
What is a sensible contactless-card precaution?
A Ignore transaction alerts
B Give it to a stranger
C Keep card under your control
D Store its PIN with it
Answer: C. Keep card under your control. Keep the card with you and review alerts; contactless availability and limits depend on the issuer and applicable rules.
How can you reduce risk at an ATM?
A Inspect the card slot
B Accept help from strangers
C Use a loose attachment
D Leave the screen signed in
Answer: A. Inspect the card slot. Look for unusual attachments or damage and use another ATM if something appears tampered with.
What may a card skimmer try to capture?
A Card data and PIN
B Your reward catalogue
C A paper statement
D Only the billing date
Answer: A. Card data and PIN. Skimming devices can capture card information, while a hidden camera or keypad overlay may capture a PIN.
How can shoulder surfing be discouraged at a payment terminal?
A Say the PIN aloud
B Shield the keypad
C Use a visible PIN
D Hand over your phone
Answer: B. Shield the keypad. Cover the keypad while entering your PIN so nearby people or cameras cannot easily see it.
What should you do if a payment terminal looks altered?
A Use another trusted terminal
B Leave your card there
C Tap twice quickly
D Enter PIN to test
Answer: A. Use another trusted terminal. Do not use a suspicious terminal; tell the merchant and choose a safer payment method or terminal.
Where should you get a bank’s card-blocking number?
A A random search ad
B Official bank website or app
C A caller’s number
D A forwarded message
Answer: B. Official bank website or app. Use a contact number from the issuer’s official app, website, or card documents.
Why enable transaction notifications?
A Raise your card limit
B Spot unfamiliar activity sooner
C Extend the due date
D Remove all card fees
Answer: B. Spot unfamiliar activity sooner. Alerts can help you notice a transaction promptly so you can contact the issuer quickly.
What should you do with a transaction you do not recognise?
A Ask social media to decide
B Share the OTP publicly
C Check details and notify issuer
D Ignore it if small
Answer: C. Check details and notify issuer. Review the transaction details and promptly raise a dispute with the issuer through its official process.
Which approach is safest for a bank message link?
A Click before checking
B Reply with CVV
C Forward it to friends
D Open the official app directly
Answer: D. Open the official app directly. Avoid unexpected links and open the bank’s app or type its verified address yourself.
How should you access card services online?
A Install an unknown app
B Use a verified issuer channel
C Follow a shortened link
D Use any free Wi-Fi portal
Answer: B. Use a verified issuer channel. Access card controls from the issuer’s verified app or website rather than an unverified link.
Why avoid sensitive card activity on public Wi-Fi?
A OTP becomes permanent
B Network privacy may be weak
C Credit score is hidden
D Card payments stop working
Answer: B. Network privacy may be weak. Public networks may be poorly secured; prefer a trusted connection and the issuer’s official app.
What does HTTPS in a website address tell you?
A Transaction is guaranteed safe
B Merchant is fully trustworthy
C No fraud can occur
D Connection is encrypted
Answer: D. Connection is encrypted. HTTPS encrypts the connection but does not prove that a merchant is legitimate or eliminate fraud risk.
How can you reduce the chance of visiting a fake bank site?
A Trust its logo only
B Use a random QR
C Check the full domain
D Ignore spelling differences
Answer: C. Check the full domain. Check the complete web address carefully; a convincing logo does not establish that a site is genuine.
What can an issuer’s temporary card lock help with?
A Pause eligible card use
B Erase old statements
C Improve the credit score
D Cancel all dues
Answer: A. Pause eligible card use. A temporary lock can restrict eligible transactions while you investigate; the issuer determines which uses are paused.
Why should card account passwords be unique?
A Make OTPs unnecessary
B Limit damage from reused passwords
C Increase reward points
D Hide billed transactions
Answer: B. Limit damage from reused passwords. A unique password reduces the chance that a breach on another service exposes your card account.
What does multi-factor authentication add to sign-in?
A An automatic cash advance
B A billing cycle
C Another identity check
D A second credit limit
Answer: C. Another identity check. Multi-factor authentication requires another proof of identity beyond a password.
Which device habit protects card apps?
A Disable screen locks
B Share the device PIN
C Install unknown APKs
D Install security updates
Answer: D. Install security updates. Security updates fix known weaknesses; keep the device protected with a screen lock.
What is a warning sign of a fake support request?
A Demand to install remote access
B Advice to use official app
C A normal statement alert
D Request to block lost card
Answer: A. Demand to install remote access. A stranger asking for remote-access software can gain control of the device and expose financial information.
What should you do if your phone with card tokens is lost?
A Share token details online
B Post its unlock code
C Secure device and contact issuer
D Wait until next bill
Answer: C. Secure device and contact issuer. Secure or erase the device using trusted tools, then contact the issuer to review tokens and card access.
When replacing a compromised card, how should recurring payments be handled?
A Share new details broadly
B Review them with issuer
C Keep using old card
D Ignore merchant notifications
Answer: B. Review them with issuer. Review recurring payments through official issuer and merchant channels; update only trusted services.
How should a physical card be stored?
A Leave it at the checkout
B Keep it in your possession
C Write PIN on it
D Lend it for verification
Answer: B. Keep it in your possession. Keep the card secure and in your control; never store the PIN with it.
How should an expired or cancelled card be discarded?
A Give it to a stranger
B Cut through chip and number
C Post a photo first
D Throw it away intact
Answer: B. Cut through chip and number. Destroy the chip and visible card number before disposal, following any issuer return instructions.
What might repeated failed payment attempts indicate?
A Automatic reward redemption
B A changed billing cycle
C A higher credit score
D Possible misuse
Answer: D. Possible misuse. Check the issuer’s alerts and contact it if attempts are unfamiliar; do not share verification codes.
Who should receive a formal card transaction dispute first?
A Card issuer through official channel
B The merchant’s social account
C An unknown caller
D A public discussion board
Answer: A. Card issuer through official channel. Raise the dispute with the card issuer using its official complaint channel and keep the reference number.
When may an RBI Ombudsman complaint generally be filed after contacting a regulated entity?
A Only after one year
B Before notifying the issuer
C Immediately without contacting it
D After 30 days without reply
Answer: D. After 30 days without reply. RBI’s Integrated Ombudsman Scheme generally allows escalation if the regulated entity has not replied within 30 days, or its response is unsatisfactory.
Why should you refuse screen-sharing requests from unknown callers?
A They lower interest rates
B They block all transactions
C They may expose banking data
D They verify card rewards
Answer: C. They may expose banking data. Screen sharing may reveal OTPs, account balances, card details, or allow remote control.
Why avoid sending a photo of both sides of your card?
A It hides your statement
B It blocks tokenisation
C It changes the card limit
D It exposes sensitive card data
Answer: D. It exposes sensitive card data. A card image may reveal the number, expiry date, and security code needed for misuse.
When is it appropriate to enter an OTP?
A For an unsolicited refund call
B For a transaction you initiated
C To verify a bank employee
D After sharing it by phone
Answer: B. For a transaction you initiated. Enter a code only in the trusted flow for a transaction or action you initiated, and check the details shown.
What should you do if an OTP arrives unexpectedly?
A Read it to the merchant
B Enter caller’s link
C Forward it to support
D Do not share; check account
Answer: D. Do not share; check account. An unexpected OTP may mean someone is attempting an action; do not share it and contact the issuer using a verified channel.
What can you do with an unwanted card token?
A Share it with another shopper
B Use it as a PIN
C Remove it through issuer controls
D Publish it online
Answer: C. Remove it through issuer controls. Where supported, review tokenised cards and deregister tokens you no longer want through the issuer or token requestor.
Why review which devices have saved card tokens?
A Increase the credit limit
B Prevent monthly statements
C Avoid all authentication
D Remove access from old devices
Answer: D. Remove access from old devices. Review registered devices and remove tokens from devices you no longer control, where the issuer provides that option.
What makes a safer card PIN?
A Written on the card
B Hard to guess, kept private
C Same as phone unlock
D Birth date shared online
Answer: B. Hard to guess, kept private. Choose a PIN that is difficult to guess, do not reuse obvious personal details, and keep it confidential.
If a bank confirms a qualifying unauthorised transaction arose from its own negligence, whose loss is it under RBI rules?
A The bank bears the loss
B The merchant always pays
C The cardholder always pays
D The telecom operator pays
Answer: A. The bank bears the loss. RBI’s customer-liability framework assigns zero customer liability in specified cases of bank negligence or deficiency.
What information helps when reporting a suspicious card transaction?
A Unrelated reward screenshots
B A stranger’s OTP
C Date, amount, reference number
D Your password and PIN
Answer: C. Date, amount, reference number. Provide relevant transaction details and preserve the issuer’s acknowledgement; never include a password, PIN, or OTP.
Which action best protects a card during an in-person purchase?
A Let staff photograph it
B Leave the terminal unattended
C Share the PIN aloud
D Keep it within sight
Answer: D. Keep it within sight. Keep the card in sight where possible, check the amount before authorising, and retain transaction alerts or receipts.