New rules for debit, credit cards begin with tokenisation today

New Delhi: The Reserve Bank of India (RBI) has made it mandatory for all credit and debit card data used in online, point-of-sale, and in-app transactions to be replaced with unique tokens by September 30 this year. This added layer of security by way of tokenisation is expected to enhance users’ digital payment experience.

The deadline was extended multiple times over the past two years at the request of stakeholders and most recently by three months starting July so that the additional time period may be utilised by the industry in facilitating all stakeholders to be ready for handling tokenised transactions.

On September 30, RBI said about 35 crore cards have been tokenised and the system is ready for the new norms which will set in from October 1. The number of tokenised cards had gone up from 19.5 crore tokens created in June, according to data shared by RBI earlier.The extension was also given for creating public awareness about the process of creating tokens and using them to undertake transactions.

Currently, many entities, including merchants, involved in an online card transaction chain store



card data like card number, expiry date, etc. [Card-on-File (CoF)] citing cardholder convenience and comfort for undertaking transactions in future.

While this practice does render convenience, the availability of card details with multiple entities increases the risk of card data being stolen or misused and there have been instances where such data stored by merchants have been compromised.

“Given the fact that many jurisdictions do not mandate Additional Factor of Authentication (AFA) for authenticating card transactions, stolen data in the hands of fraudsters may result in unauthorised transactions and resultant monetary loss to cardholders. Within India as well, social engineering techniques can be employed to perpetrate frauds using such data,” RBI had earlier said.

In reaction, the RBI initially mandated that after December 31, 2021, entities other than card networks and card issuers cannot store card data.

As per the RBI, tokenisation refers to the replacement of actual card details with an alternate code called the “token”.