Introducing new channels for Card-on-File Tokenisation

 Introducing new channels for Card-on-File Tokenisation

The Reserve Bank of India (RBI) introduced Card-on-File Tokenisation (CoFT) in September 2021, marking a significant step in enhancing the security and efficiency of electronic transactions.

The implementation of CoFT began on October 1, 2022, and its impact has been noteworthy.

To date, more than 56 crore tokens have been generated, facilitating transactions totaling over ₹5 lakh crore.

This demonstrates the widespread adoption and acceptance of tokenisation as a security measure in the digital payment landscape.

Tokenisation has played a crucial role in bolstering transaction security, ensuring that sensitive card details are shielded from potential security breaches.

Additionally, it has contributed to an improved transaction approval rate, making electronic payments smoother and more reliable for both consumers and merchants.

Previously, the creation of Card-on-File (CoF) tokens was primarily the domain of merchants, involving their applications or webpages.

However, there is now a proposal to expand the token creation process directly at the issuer bank level.

 

This proposed measure holds the promise of greater convenience for cardholders, as they will have the option to easily create tokens and link them to their existing accounts with various e-commerce applications.

This step is poised to simplify and streamline the tokenisation process, ultimately benefiting consumers and promoting the adoption of secure digital payments.

RBI is set to issue specific instructions regarding this enhancement, further solidifying its commitment to advancing the security and accessibility of electronic transactions.

Tokenization is the process of converting actual card details into a unique token, while de-tokenization involves converting the token back into the original card details.

Tokenization offers enhanced security for card transactions because it prevents the sharing of actual card details with merchants during transaction processing. Instead, a token representing the card is used, minimizing the risk of sensitive information exposure.

Customers can initiate tokenization by requesting it through an app provided by the token requestor. The request is then sent to the card network, which, with the consent of the card issuer, generates a corresponding token for that specific card, token requestor, and device.

Tokenization is permitted on various consumer devices such as mobile phones, tablets, laptops, wearables, and IoT devices for different use cases, including contactless card transactions, payments through QR codes, and app-based payments.

Tokenization and de-tokenization can be performed by authorized card networks or card issuers. The RBI provides a list of authorized card networks operating in India.

 

In tokenized card transactions, key stakeholders include the merchant, merchant's acquirer, token service provider, token requestor, issuer, and the customer. However, other entities may also participate in the transaction.

Card details, tokens, and relevant information are securely stored by the token service provider, ensuring the safety of customer data. Token requestors must meet international safety and security standards.

Tokenization is not mandatory for customers; they have the choice to decide whether to tokenize their cards. Customers can also select tokenization for specific use cases like contactless, QR code-based, or in-app payments.

Registration for tokenization requires explicit customer consent through Additional Factor of Authentication (AFA), ensuring customers are fully aware and in control of the process.

Customers can set and modify transaction limits for tokenized card transactions, allowing them to customize their security preferences.

Customers can request tokenization for any number of cards, and they are free to use any of the registered cards with the token requestor app for transactions.

 

Additional Reading:

Tokenisation – Card transactions dt.Jan 08, 2019 @ https://www.rbi.org.in/scripts/FS_Notification.aspx?Id=11449&fn=9&Mode=0

Tokenisation – Card Transactions: Permitting Card-on-File Tokenisation (CoFT) Services dt.September 07, 2021 @ https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12159&Mode=0

 

MasterCard Issuer-Initiated Tokenization @ https://developer.mastercard.com/mdes-pre-digitization/documentation/use_case/issuer-tokenization/

 

Disclaimer: These views represent my personal perspective and understanding at the moment. As operating guidelines evolve and become more defined, my understanding may also evolve. However, our unwavering commitment remains focused on spreading the Joy of Safe ePayments.

 

Diabetes Care Motivator #DiabetesCareMotivator