Content: Recently the Reserve Bank of India (RBI) signalled that it would not extend deadline for implementation for tokenization of card based payments and mandated the adoption of card-on-file (CoF) tokenisation as an alternative to card storage. This rule is applicable to all stakeholders except card issuers and card networks.
In this context let us understand the process of Tokenization.
What is Tokenization?
Tokenisation is a process by which card details are replaced by a unique code or token, allowing online purchases to go through without exposing sensitive card details.
Under tokenisation services, a unique alternate code is generated to facilitate transactions through cards.
It is the process of substituting a 16 digit customer card number with a non-sensitive equivalent value, referred to as a token.
This essentially means that a customer’s card information will no longer be available on any Merchant, Payment Gateway, or 3rd party that helps in the processing of digital transactions today.
With card tokenisation, consumers no longer need to fear saving their card details.
Cardholders will have to give an explicit consent that will be collected for tokenisation.
Who can offer tokenisation services?
Tokenisation can be performed only by the authorised card network and recovery of original Primary Account Number (PAN) should be feasible for the authorised card network only.
Adequate safeguards have to be put in place to ensure that PAN cannot be found out from the token and vice versa, by anyone except the card network. RBI has emphasised that the integrity of the token generation process has to be ensured at all times.
What is the size of the industry?
As per the RBI’s annual report for 2021-22, during 2021-22, payment transactions carried out through credit cards increased by 27 per cent to 223.99 crore in volume terms and 54.3 per cent to 9.72 lakh in value terms.
Why RBI wants cards to be tokenized?
Customer’s card details are stored by merchants, and if their security measures are inadequate, this puts all the customers at risk. There have been several instances in the past where merchant websites have been hacked and debit and credit card details have been leaked. This is what the RBI wants to eliminate.
By mandating card tokenization, the burden of security is now on payment processors and banks, not merchants.
Thus, a tokenised card transaction is considered safer as the actual card details are not shared with the merchant during transaction processing.
Tokenization ensures standardization for card on file transactions through higher security standards which is irreversible as compared to existing reversible cryptographic standards.
How does this card tokenisation work?
At check-out time on an online shopping portal, one has to enter card details and opt for tokenisation. The merchant forwards it to the respective bank or the card networks (VISA, Rupay, Mastercard, etc). A token is generated and sent back to the merchant, which then saves it for the customer.
Now, the next time the customer comes back to shop, she has to just select this saved token at check-out time. The same masked card details and last four digits of customer’s card number will be visible. Customer needs to enter your CVV and complete the transaction.
The customer, does not need to remember the token. The end-customer experience is not changing while making the payment.
The implementation of the tokenisation request is carried out through the Additional Factor of Authentication (AFA) by the cardholder.
This algorithmically generated token protects sensitive information and prevents card frauds as it allows you to make payments without exposing your bank details.
Benefits of tokenization in a nutshell:
Largely designed to counter online frauds and curb digital payment breaches, tokenization comes with a slew of benefits. Some of them are:
Enhanced safety and security: Tokens generated will be unique to a single card at a specific merchant and this will take up the overall security of making card-based transactions. It eliminates the risk of storing card details online and ensures the uncompromised convenience of storing customer’s token details on the merchant site.
Quicker checkouts: Tokenized Mastercard will allow the convenience of quick checkouts as one doesn’t need to punch in the card number for each purchase.
No more ‘False Declines’: Many times, legitimate online payments using valid cards are declined on the grounds of the transaction looking like a fraud. With tokenization, this becomes a thing of the past as the usage of tokens for payments confirms security of the highest order.
Easy card management: With tokenization, one can also keep track of all your cards and the merchants they have been tokenized with.
No need for a physical card: With tokenization, one can store a virtual version of one’s card on a smartphone for the days one forgets to carry your wallet.
Added benefits: Tokenization also comes with cashback benefits when secured with platforms like Amazon, Paytm, Swiggy, Flipkart and Phonepay among others.
