At a time when data theft is on rise, it's worthwhile to follow advice of RBI to opt for tokenisation in card usages
Eleven people, including the manager of a Noida software firm, were arrested in February 2022 for allegedly stealing and misusing credit cards of about 100 people across the country. In October 2019, the RBI asked banks to secure their customer card data after a website reported that nearly 1.3 million debit and credit card data of Indian banks are on sale on the dark web, potentially causing losses of millions of dollars.
There are millions of people using credit and debit cards on a regular basis. As a measure to safeguard the interest of cardholders, the Reserve Bank of India proposed a process called ‘tokenisation’. Credit and debit card tokenization is the process of replacing sensitive data with a token, a randomly generated, one-of-a-kind placeholder, from the company’s internal network.
The Reserve Bank of India on June 24 extended the timeline for tokenisation of debit and credit cards by three months till September 30, 2022 "to avoid disruption and inconvenience to cardholders". Originally, the RBI mandated that after December 31, 2021, entities other than card networks and card issuers cannot store card data. This timeline was subsequently extended to June 30, 2022.
Now after September 30, no entity in the card transaction or payment chain, other than the card issuers and card networks, should store the CoF (Card-on-File data or storage of actual card data) and any such data stored previously will be purged.
"On a review of the issues involved and after detailed discussions with all stakeholders, it is observed that considerable progress has been made in terms of token creation. Transaction processing based on these tokens has also commenced, though it is yet to gain traction across all categories of merchants," the RBI said in a circular to payment system providers.
In its press release issued on June, 24, 2022, the RBI also urged credit and debit card holders to opt for tokenisation on a voluntary basis. It will be worthwhile for credit and debit card holders to try this sane advice of RBI for a smooth transition, when it is made compulsory in course of time.
Currently, many entities, including merchants, involved in an online card transaction chain store card data like card number, expiry date, etc., [Card-on-File (CoF)] citing cardholder convenience and comfort for undertaking transactions in future. While this practice does render convenience, availability of card details with multiple entities increases the risk of card data being stolen/misused. There have been instances where such data stored by merchants, etc., have been compromised.
Under the present system as an additional factor of authentication is not mandatory, there is always a possibility of fraudsters using the stolen data and the cardholders may be put to monetary loss. It is possible that social engineering techniques can be employed to perpetrate frauds using such data.
The RBI has issued a framework for CoF Tokenisation (CoFT) services. Under this framework, cardholders can create “tokens” (a unique alternate code) in lieu of card details; these tokens can then be stored by the merchants for processing transactions in future. Thus, CoFT obviates the need to store card details with merchants and provides the same level of convenience to cardholders.
To create a token under the CoFT framework, the cardholder has to undergo a one-time registration process for each card at every online/
e-commerce merchant’s website/ mobile application, by entering the card details and giving consent for creating a token. This consent is validated by way of authentication through an Additional Factor of Authentication.
Thereafter, a token is created which is specific to the card and online / e-commerce merchant, i.e., the token cannot be used for payment at any other merchant. For future transactions performed at the same merchant website/mobile application, the cardholder can identify the card with the last four digits during the checkout process. Thus, the cardholder is not required to remember or enter the token for future transactions. A card can be tokenised at any number of online/e-commerce merchants. For every online/e-commerce merchant where the card is tokenised, a specific token will be created.
The RBI has also said that 19.5 crore tokens have been so far created. Opting for CoFT (i.e., creating tokens) is voluntary for the cardholders. Those who do not wish to create a token can continue to transact as before by entering card details manually at the time of undertaking the transaction.
The Reserve Bank of India encourages cardholders to tokenise their cards for their own safety. Cardholders’ payment experience will be enhanced through an added layer of security by way of tokenisation.
(The writer is a retired banker. The views expressed are personal.)