How to Tokenize Credit Card and Debit Card
How to Tokenize Debit Card, How to Tokenize Credit Card : Do THIS for Safer Transactions
The Reserve Bank of India (RBI) is encouraging debit and credit cardholders to tokenise their cards in order to protect the cards from frauds. The Card tokenisation will replace the actual card details with an alternate code which will be specific to the card and online merchant. For all online transactions, Tokenisation will act as an additional layer of security.
Currently, card details like card number, expiry date are stored with the merchants involved in an online transaction or in cloud systems known as card-on-file (CoF), citing cardholder convenience and comfort for undertaking transactions. However, this increases the risk of the card data being misused. Also, many jurisdictions do not mandate an additional factor of authentication, and stolen data can result in unauthorised transactions.
As per RBI guidelines, after December 31, 2021, entities other than card networks and card issuers cannot store data. The deadline was extended to June 30,2022 which was further extended to September 30, 2022.
How to Tokenize Debit Card or How to Tokenize Credit Card
In order to create a token first, the cardholder has to do a one-time registration for each card at every online merchant’s website or mobile application by entering the card details and giving consent for creating a token. The consent to create a toekn will be validated through an additional factor of authentication and then the token will be created. The token once created, will be specific to the card and the online merchant. The same token cannot be used and will not work for any other online merchant. One card can be tokenised at any number of online merchants and for every online merchant, a specific token will be created.
The cardholder can identify the card with the last four digits during the checkout process once the token for a specific online merchant is created. There is no need for the cardholder to remember or enter the token for future transactions. The tokenisation process will be done without any charges.
Opting for CoF tokenisation is voluntary for the cardholders and people who do not wish to create a token can do so and they will need to enter card details manually at the time of checkout transaction.
Entities can store limited data—last four digits of actual card number and card issuer’s name—in compliance with the applicable standards for transaction tracking and / or reconciliation purposes.
Card issuers need to ensure easy access to customers for reporting loss of “identified device” or any other such event which may expose tokens to unauthorised usage.
Dispute resolution process will be placed by the card network for tokenised card transactions.
Also, it is mandatory for card networks to ensure monitoring to detect any malfunction, anomaly, suspicious behaviour or the presence of unauthorised activity within the tokenisation process. Based on any risk, card issuers may decide whether to allow cards issued by them to be registered by a token requestor.
