Tag: card data

Industry view: Tokenisation circular modifications give banks more control over card data

Banking & Finance

[ad_1]

Read More/Less


The facility of tokenisation shall be offered by TSPs only for the cards issued by them, and the ability to tokenise and de-tokenise card data shall be with the same TSP.

The modifications made on Tuesday to the guidelines on tokenisation of card-based transactions allow banks a greater control over their customers’ data, said industry players.

The Reserve Bank of India (RBI) on Tuesday issued a set of relaxations with respect to its earlier mandate of tokenisation of card transactions. The regulator permitted card issuers to offer tokenisation services and become token service providers (TSPs). The facility of tokenisation shall be offered by TSPs only for the cards issued by them, and the ability to tokenise and de-tokenise card data shall be with the same TSP.

The tokenisation or encryption of card data shall be done with explicit customer consent with an additional factor of authentication (AFA) validation by the card issuer.

This means while card users can still choose to store their card details with a payment aggregator if they choose to, they will not be able to do so by checking a box, as was the case thus far. Instead, they will have to provide their explicit consent through an OTP or some similar instrument. The new rules kick in from January 1, 2022.

Madhusudanan P, co-founder and CEO, YAP by M2P Solutions, said with the latest relaxation, the RBI has given a fresh lease of life to tokenisation by payment aggregators. “The crux of it lies in enabling banks to be in control of the whole tokenisation service, which was earlier limited to third-party intermediaries. Now, if a large bank wants to be in control of their customers’ data because they see it as an important function, they can do the tokenisation themselves,” he said.

Sanjeev Moghe, EVP & head — cards & payments, Axis Bank, said the regulation will help prevent instances of unauthorised usage of customer data, theft and misuse of cards. “With tokenisation, a card-specific token is generated. Going forward, that token can be used for all online transactions. This will ensure an enhanced security. In case of any data breach or hacking attempt at the merchant’s end, the customer’s card details will still be protected,” Moghe said.

The mandate to tokenise all card information while carrying out transactions had become a sticky point for the payments industry, as they saw the new guidelines to be detrimental to the experience of smooth checkouts. Last month, industry body Payments Council of India had said the industry was working in alignment with the RBI on possible secure card-on-file tokenisation (CoFT) solutions to ensure a smooth customer experience for online purchases while enhancing the security of the storage of card credentials.

“It may be noted that introduction of CoFT, while improving customer data security, will offer customers the same degree of convenience as now,” the RBI said on Tuesday, adding, “Contrary to some concerns expressed in certain sections of the media, there would be no requirement to input card details for every transaction under the tokenisation arrangement.”

“The regulator has expanded the scope of tokenisation to include things like wearables and other devices. Eventually, we could even see tokenisation rules applied to payments for transit systems,” said an expert on condition of anonymity.

Get live Stock Prices from BSE, NSE, US Market and latest NAV, portfolio of Mutual Funds, Check out latest IPO News, Best Performing IPOs, calculate your tax by Income Tax Calculator, know market’s Top Gainers, Top Losers & Best Equity Funds. Like us on Facebook and follow us on Twitter.

Financial Express is now on Telegram. Click here to join our channel and stay updated with the latest Biz news and updates.



[ad_2]

CLICK HERE TO APPLY

Leave a comment , ,

Only card networks and issuing banks may get to tokenise data, BFSI News, ET BFSI

Banking & Finance

[ad_1]

Read More/Less


Only card-issuing banks and card scheme operators, such as the National Payments Corporation of India, Visa and Mastercard, would be allowed to tokenise customer card data, Reserve Bank of India (RBI) is said to have indicated to the industry in a meeting Monday.

The central bank has clarified to the industry that none of the intermediaries, even licensed payment gateways and acquiring banks, would be allowed to store card data and offer tokenised files to merchants under the upcoming payment aggregator and payment gateway regulatory regime kicking in from 2022, two sources aware of the matter told ET.

Under the new norms, every online merchant processing transactions for customers will only have access to a ‘tokenised’ key linked with the consumer’s cards instead of the entire card file. The meeting saw participation of members from industry pockets such as payments, banking and web-commerce, the sources added.

“The central bank has reiterated its stance that it only sees tokenisation as an alternative solution for merchants aiming to offer a one-click checkout facility to customers,” said a source present at the meeting.

“It has also been made clear that only card networks and issuing banks will be allowed to tokenise files corresponding to customer card details. Payment aggregators and merchants will have to devise systems to avail this tokenised link from their respective banks or networks,” the person added.

Tokenisation is an encryption technology that enables card operators to mask actual details of a debit or credit card by substituting with a secure, unique digital token linked to a customer device.

Only this proxy token can be stored by merchants and aggregators to process payments to offer one-click checkouts. Those merchants without access to tokenised links will have to ask customers to fill in the entire details of their card including the 16-digit number every time they make a payment.

The central bank’s insistence on strict card storage norms is on the back of several recent high-profile cyber attacks such as those on JusPay, Mobikwik, Big Basket, Air India and Upstox.

RBI is said to be firm on its stand on customer security where it doesn’t want entities that are not under its direct supervision to be storing card details of customers on servers.

While payment aggregators will be allowed to store card details for processing of redressals and chargebacks, the new rules will stipulate a fixed time under which this data will have to be deleted.

ET reported last week that industry forums, including the Payments Council of India (PCI), have suggested alternative solutions beyond encryption through tokenisation – such as secure reference on files – to minimise customer inconvenience to the central bank.

RBI didn’t respond to ET’s mailed queries.



[ad_2]

CLICK HERE TO APPLY

Leave a comment , , , , , ,

RBI against dropping card data storage clause in new rules, BFSI News, ET BFSI

Banking & Finance

[ad_1]

Read More/Less


The Reserve Bank of India (RBI) has rejected a demand by India’s payment gateways for exemptions on select new regulatory norms that are set to prohibit merchants from storing card details and payment operators from offering one-click checkout service to consumers from January 2022, three sources aware of the matter told ET.

The new Payment Aggregator/Payment Gateways (PA/PG) rules will mandate every online merchant processing transactions for customers to only have access to a ‘tokenised’ key linked with the consumer’s cards instead of the entire card file. While authorised card operators will be allowed to store card details for seamless processing of redressals and chargebacks, the new rules will prohibit the usage of this data even by authorised operators for auto checkouts.

This means millions of card holders – both debit and credit – making payments online in 2022 may have to enter their 16-digit card numbers every time they make a payment online as opposed to just authenticating these transactions through the CVV (card verification value) and the one-time password (OTP) as is the current norm.

“The RBI’s new rules have been framed keeping security of the consumers as paramount,” said an industry official aware of the matter. “The current system, while seamless, is prone to breaches and cyber risks as customer card details are being stored in the servers of merchants not directly under the supervisory purview of the central bank.”

The Payments Council of India (PCI) lobby group has suggested alternative solutions beyond encryption through tokenisation–such as secure reference on file–to minimise customer inconvenience. They argue that as licensed aggregators are storing card data on isolated servers for chargeback references, these may be used for allowing one-click checkouts subject to consumer consent.

PCI has also sought a further extension of the deadline for compliance in its letter to the RBI.

“To allow regulated entities to develop and implement solutions that meet the criteria, as well as to ensure consumers are informed, we request sufficient time to be allowed to ensure the entire card ecosystem is prepared to handle card transactions under new solutions without adverse unintended consequences,” said the letter reviewed by ET.

To be sure, the rules were initially set to be enforced from July 2021. The RBI extended this by six months after the industry lobbied for it.

The RBI didn’t respond to queries.

The gateways say customers will see experience friction in subscription-based services that require storage of card data to bill them on a recurring basis. Without the customer data, merchants will have to ask for the card information in every billing cycle, which will result in business disruption, they say.

“While this directive from the RBI is right in intent, it leads to a blanket prohibition for service provider merchants from storing customers’ financial information, even when the said merchants may have the requisite security norms in place or may intend to have one for the same, thereby affecting smooth flow of online payments,” said Rameesh Kailasam, CEO and president of IndiaTech, an industry grouping of startups.

Earlier in the year, IndiaTech had made representations to both the RBI and the finance ministry to allow merchants with adequate security compliances to handle customer data without encryption to prevent disruption to seamless checkouts. Kailasam said IndiaTech is preparing another representation to reiterate this point to the central bank ahead of the deadline.

“It is important to understand here that from a practicality standpoint, device tokenisation may not work in all use cases, like subscription businesses and payments that are device agnostic,” he said.

ET reported Thursday that at least 30 firms including Tata Group, Amazon, Zomato and PhonePe have applied for PA/PG authorisation under the new RBI rule, which was formally introduced in March 2020. The widespread interest among internet firms to apply for an aggregator licence can also be explained by their intent to convert themselves from merchants to payment processors to ensure reduced friction in payment processing for customers.

“The central bank is firm on its stand to not allow any more extensions as of now as the ecosystem has seen several high-profile breaches, mostly at the end of merchants and unauthorised payment aggregators,” said the chief executive of a payment gateway present at the meeting with RBI representatives earlier this month. This year has seen high-profile cyberattacks such as those on JusPay, Mobikwik, Air India and Upstox.



[ad_2]

CLICK HERE TO APPLY

Leave a comment , , , , , , , , ,

Researcher, BFSI News, ET BFSI

Banking & Finance

[ad_1]

Read More/Less


Independent cybersecurity researcher Rajshekhar Rajaharia claimed on Sunday that data of nearly 10 crore credit and debit card holders in the country is being sold for an undisclosed amount on the Dark Web.

According to Rajaharia, the massive data dump on the Dark Web has been leaked from a compromised server of Bengaluru-based digital payments gateway Juspay.

JusPay told IANS that no card numbers or financial information were compromised during the cyber-attack and the actual number is much lower than the 10 crore-figure being reported.

“On August 18, 2020, an unauthorised attempt on our servers was detected and terminated when in progress. No card numbers, financial credentials or transaction data were compromised,” a company spokesperson said in a statement.

“Some data records containing non-anonymised, plain-text email and phone numbers were compromised, which form a fraction of the 10 crore data records,” the spokesperson added.

However, Rajaharia claimed that the data was being sold on the Dark Web for an undisclosed amount via cryptocurrency Bitcoin.

“For this data, hackers are also contacting via Telegram,” he told IANS.

According to him, PCI DSS (Payment Card Industry Data Security Standard) have been followed by Juspay in storing users’ card information.

“However, if the hackers can find out the Hash algorithm used to generate the card fingerprint, they will be able to decrypt the masked card number. In this condition, all 10 crore cardholders are at risk,” Rajaharia noted.

The company admitted that the hacker gained access to one of Juspay’s developer keys and was spawning new computation servers in the developer account, trying to gain access to any accessible data.

Juspay, however, said the masked card numbers that have been leaked are not considered sensitive as per compliance.

Only “few” phone numbers and email addresses have been leaked which have dummy values, the spokesperson said, adding that it had intimated its merchant partners about the data leak the very same day.

“No card numbers (like 16-digit card number and other financial credentials) were accessed, as it is stored in a completely different isolated system. No transaction or order information was compromised,” the company spokesperson informed.

“We are making long-term investments for strengthening security and data governance with industry experts,” the company said.

Founded in 2012, Juspay last year raised $21.6 million in its Series B funding round.

The round was led by Sweden’s Vostok Emerging Finance (VEF), which invested $13 million in the technology firm, marking its first investment in the country.



[ad_2]

CLICK HERE TO APPLY

Leave a comment , , , , ,