Debit Card Tokenization

Recently, the Reserve Bank of India (RBI) announced a new regulation stating that Debit Card, Credit Card data online, point-of-sale (POS) and in-app purchases will be replaced with unique tokens by 30^th September 2022. The new regulation aims to create an added layer of security whenever an online payment is conducted via Debit Card or Credit Card.  

Effective 1^st October 2022, online merchants cannot store a customer’s card number, CVV, card PIN or any other sensitive information if that customer opts for Debit Card Tokenisation.

Tokenisation is a process where a customer’s actual card details are replaced with a unique code called a “token”. So, whenever a customer makes a purchase on a website or an app via a Debit Card, he/she can opt for Tokenisation of the Debit Card. It is not mandatory for a customer to get the card tokenised. It can be done through mobile phones/tablets without incurring any cost.

Follow the below steps to generate a token for a Debit Card:

• Step 1: Start

Visit any e-commerce website or application to make a purchase & start a transaction    

• Step 2: Choose your Card

During check-out, enter the details of your Debit Card. You can also select the Debit Card saved earlier as the payment method and proceed

• Step 3: Secure your Card

Select between the two options: a) Secure your card as per RBI guidelines OR b) Tokenise your card as per RBI guidelines

• Step 4: Provide a Permission for Token Creation

Enter the OTP sent on your phone or email by your bank & complete the transaction

• Step 5: Generate a Token

Your token is now generated, and this is saved as against the actual details of your card

• Step 6: Tokenised

When you visit the same page or website for purchase, the last four digits of your Debit Card will be visible to you to help you identify your card for payment. Your Debit Card is now Tokenised!

• In the Tokenisation process, the Debit Card’s 16-digit number is substituted by a unique token which is a randomly created alphanumeric ID.
• The process keeps sensitive data secured and prevents breaches of payment processed through a Debit Card.
• Tokenisation safeguards Debit Cards & Bank Account details so that organizations can transfer data over wireless networks in a secure manner.

So, here’s an illustration of how it works:

• A customer initiates a transaction on a website or app & enters the Debit Card number
• The card details are sent to the merchant-acquiring bank in the form of a token
• The acquirer transfers the token ID to the Debit Card issuer for authorization
• After authorization, the customer’s Debit Card details get stored in Virtual Vaults and the token gets matched to the Bank Account number
• The bank verifies the payment
• Once the authorization is successful, then the unique token is transferred to the merchant for current & future transactions

Both Tokenisation and de-Tokenisation can be performed by the authorised card network or by the card issuer.

• Helps to prevent Debit Card payment processing breach
• Provides added layer of security for e-commerce websites, thus increasing consumer trust & loyalty
• Makes Debit Card payments more secure

Read More: How do I choose a Debit Card?

• As discussed above, Tokenisation is the best way to secure your payments via Debit Card/Credit Card/Contactless Card, etc.
• Any customer can opt for it without paying any charges. One can even opt-out or de-register without any hassle.

Sources:

https://www.rbi.org.in/commonman/English/Scripts/FAQs.aspx?Id=2917

https://twitter.com/RBIsays/status/1552158198937026560?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1552158198937026560%7Ctwgr%5Edb3deb41a107677b03847b8114d9fb487a557783%7Ctwcon%5Es1_&ref_url=https%3A%2F%2Feconomictimes.indiatimes.com%2Fwealth%2Fsave%2Fhow-to-tokenise-your-debit-credit-card-in-6-steps%2Farticleshow%2F93182492.cms

The list of card issuers authorized by RBI to do Tokenisation/de-Tokenisation are available here: https://www.rbi.org.in/Scripts/PublicationsView.aspx?id=12043.