How RBI plans to ensure security of card data

In a bid to ensure security of card data, the Reserve Bank of India (RBI) has enhanced the scope of tokenisation and permitted card issuers to act as token service providers (TSP).

Under tokenisation services, a unique alternate code is generated to facilitate transactions through cards.

The RBI on Tuesday extended the device-based tokenisation to card-on-file tokenisation (CoFT) services, a move that will bar the merchants from storing actual card data.

Card-on-file refers to card information stored by payment gateway and merchants to process future transactions.

"...card issuers have been permitted to offer card tokenisation services as token service providers. The tokenisation of card data shall be done with explicit customer consent requiring additional factor of authentication (AFA)," the RBI said in a statement while extending device-based tokenisation framework to CoFT services.

It said the decision will reinforce the safety and security of card data while continuing the convenience in card transactions.

The RBI said that citing the convenience and comfort factor for users while undertaking card transactions online, many entities involved in the card payment transaction chain store actual card details.

Some merchants force their customers for storing card details.

Availability of such details with a large number of merchants substantially increases the risk of card data being stolen.

In the recent past, there were incidents where card data stored by some merchants have been compromised/ leaked.

Any leakage of CoF data can have serious repercussions because many jurisdictions do not require an AFA for card transactions, the RBI said adding that stolen card data can also be used to perpetrate frauds within India through social engineering techniques.

The RBI in March 2020 had stipulated that authorised payment aggregators and the merchants onboarded by them should not store actual card data with a view to minimise vulnerable points in the system.

On a request from the industry, it extended the deadline to end-December 2021 as a one-time measure.

The tokenisation of card data, however, shall be done with explicit customer consent requiring AFA, it added.

These enhancements, the RBI said, "are expected to reinforce the safety and security of card data while continuing the convenience in card transactions".

The RBI said that the CoFT, while improving customer data security, will offer customers the same degree of convenience as now.

"Contrary to some concerns expressed in certain sections of the media, there would be no requirement to input card details for every transaction under the tokenisation arrangement," RBI said.

The efforts of the RBI to deepen digital payments in India and make such payments safe and efficient shall continue.

The Reserve Bank of India last month had extended the scope of 'tokenisation' card payment services to several consumer devices including laptops, desktops, wearables like wrist watches, bands and Internet of Things (IoT), in addition to mobile phones and tablets.

Photograph: PTI Photo