When buying a product online, we are often forced to store our credit or debit card details on the e-commerce platform. To ensure safety of this, the Reserve Bank of India issued guidelines last month, allowing card-on-file tokenisation.
Recently, Visa, a digital payments platform, launched its card-on-file tokenisation service in India.
Here’s what you need to know about the upcoming advancement in India’s digital payments system:
What is tokenisation?
As per guidelines, tokenisation is when credit or debit card details can be replaced with an alternate code, called “token”, which can be generated by the holder to make payments without entering their account details.
This devaluation of card details reduces risk and vulnerability of sensitive data, thereby reducing the chances of fraud arising from sharing card details.
Furthermore, if the customer wants to convert its token back to their actual card details, they can do so. This process is known as de-tokenisation.
What is a token, and how can it be used?
The 16-character “token” generated is free-of-cost, and can be used to perform contactless card transactions at point-of-sale (PoS) terminals, QR code payments, and now for card-on-file (CoF) transactions.
A customer can make a CoF transaction, after authorising a token to their merchant. The merchant can store the token, and use that to bill the customer’s products. Merchants here can be refered to e-commerce companies, airlines and supermarket chains.
The RBI has directed merchants not to store customers’ card details in their systems from January 1, 2022.
How do you generate a token?
The cardholder can generate a token by first requesting for a token on the app provided by the token requestor – the entity that accepts request from the customer for tokenisation of a card. Then, the company will pass the request on to the card network to issue a token. The card network, after seeking consent of the card issuer, will issue a token, which will have a combination of the card, the token requestor, and the device.
This process can be done through mobile phones or tablets for all use cases and channels like contactless card transactions, payments through QR codes and apps.
Tokens are generated by payment companies, which act like Token Service Providers (TSPs). They will provide tokens to mobile payment or e-commerce platforms so that the token can be used during transactions.
If a customer enters their card details in a virtual wallet like Google Pay, these platforms ask one of these TSPs for a token. Only after the TSPs get the go-ahead from the customer’s bank, a code is generated and sent to the user’s device. Once the token has been generated, it remains linked to the device and cannot be replaced.
Consequently, each time a customer uses their device to make a payment, the payments platform can authorise the transaction by simply sharing the token.
How can you register for tokenisation, and is it mandatory?
The ability to tokenise and de-tokenise card data will be with the same TSP, and if a customer wishes to register their card for tokenisation, they will have to first give their consent through Additional Factor of Authentication (AFA), RBI says. Tokenisation is not mandatory, and the customer will be given a choice of selecting the use case and setting-up of limits. The stakeholders involved in a tokenised card transaction are the merchant, the merchant’s acquirer, card network, token requestor, issuer and customer.
Financial Express is now on Telegram.