RBI Enhances Scope for Card Tokenisation for CoFT Services to Improve Customer Data Security

RBI said “explicit customer consent” will be required for tokenisation of card data.

By ANI | Updated: 8 September 2021 15:10 IST

RBI Enhances Scope for Card Tokenisation for CoFT Services to Improve Customer Data Security

RBI noted that the introduction of CoF will offer customers the same degree of convenience as now

Highlights

Above enhancements are expected to reinforce the safety of card data
Tokenisation of card data shall be done with explicit customer consent
Entities involved in transaction chain can store actual card details

The Reserve Bank of India (RBI) on Tuesday enhanced the guidelines on card tokenisation services to improve the safety and security of the payment system. In a release, RBI said the device-based tokenisation framework advised vide circulars of January 2019 and August 2021 has been extended to card-on-file tokenisation (CoFT) services as well. Further, the card issuers have been permitted to offer card tokenisation services as Token Service Providers (TSPs).

"The tokenisation of card data shall be done with explicit customer consent requiring Additional Factor of Authentication (AFA)," RBI said.

The release said that the above enhancements are expected to reinforce the safety and security of card data while continuing the convenience in card transactions.

[Sponsored] Samsung Galaxy S24: The Ultimate Camera Phone With Smarter On-Device AI

RBI said citing the convenience and comfort factor for users while undertaking card transactions online, many entities involved in the card payment transaction chain can store actual card details, also known as card-on-file (CoF).

"In fact, some merchants force their customers to store card details. Availability of such details with a large number of merchants substantially increases the risk of card data being stolen. In the recent past, there were incidents where card data stored by some merchants have been compromised/ leaked. Any leakage of CoF data can have serious repercussions because many jurisdictions do not require an AFA for card transactions. Stolen card data can also be used to perpetrate frauds within India through social engineering techniques," said the release.

RBI had, therefore, stipulated in March 2020 that authorised payment aggregators and the merchants onboarded by them should not store actual card data.

India's Ban on Mastercard Said to Hit Banks' Card Operations

"This would minimise vulnerable points in the system. On a request from the industry, the deadline was extended to end-December 2021, as a one-time measure. RBI has been in regular consultation with the industry to facilitate the transition," informed the release.

RBI noted that the introduction of CoFT, while improving customer data security, will offer customers the same degree of convenience as now.

"Contrary to some concerns expressed in certain sections of the media, there would be no requirement to input card details for every transaction under the tokenisation arrangement. The efforts of Reserve Bank to deepen digital payments in India and make such payments safe and efficient shall continue," added the release.

How will India's new liberalised drone rules impact the industry? And where are they left wanting? We discussed this on Orbital, the Gadgets 360 podcast. Orbital is available on Apple Podcasts, Google Podcasts, Spotify, Amazon Music and wherever you get your podcasts.

Affiliate links may be automatically generated - see our ethics statement for details.

Comments

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.