RBI proposes card-on-file tokenisation: Tighter security, more convenience for customers

RBI Governor Shaktikanta Das on October 6 proposed the introduction of card-on-file tokenisation (CoFT) facility at the issuer-bank level.

Soon, you will be able to generate card tokens on your bank’s website or app instead of e-commerce websites / apps while shopping online, as is the case at present. This will eliminate data security concerns regarding token generation at e-commerce or merchant portals. Thus, customers will have greater control over managing their card tokens once the Reserve Bank of India’s (RBI) proposal is implemented.

RBI Governor Shaktikanta Das on October 6 proposed the introduction of card-on-file tokenisation (CoFT) facility at the issuer-bank level, citing the growing acceptance and benefits of tokenisation of card data. This measure will enhance convenience for cardholders, as they can get tokens created and linked to their accounts with various e-commerce applications, he added. Since the tokenisation will now be effected only at the issuer bank’s portal or app, the risk of a third-party portal gaining access to your sensitive information in case of any data breach will be neutralised.

Khilan Haria, SVP and Head of Payments Product, Razorpay, says, “RBI’s announcement on CoFT empowers cardholders to create tokens across merchants, eliminating payment friction and the need to manually enter card data. This seamless user experience will enhance the customer journey while also aiding banks with increased activation and spends.’’

“The proposal to introduce card-on-file tokenisation directly at the card issuing bank is a game-changer for both cardholders and the financial industry as a whole,” says Rajsri Rengan, India Head of Development, Banking, and Payments, at FIS, a fintech firm.

Also read | RBI holds interest rates, markets move on, your EMIs remain unchanged

Benefits of CoFT 

Until now, CoFT could be done only on a merchant application or webpage at the time of making a payment.

“The expectation is that once this is implemented, you would be able to create and manage your card tokens for e-commerce sites directly from your bank account, pretty much like setting your credit and spending limits over net banking or your banking app,” explains Adhil Shetty, CEO, BankBazaar.com. He adds that this gives you greater control over managing your card token and allows you to add and delete tokens without accessing the merchant website.

``CoFT empowers cardholders with an extra layer of protection, safeguarding data which would otherwise be vulnerable during card transactions,’’ says Rahul Jain, CFO, NTT DATA Payment Services, India.

Also read | RBI proposes changes to strengthen banks’ internal ombudsman framework

Minimal challenges

“This process poses minimal challenges for issuer banks, as most of them can leverage the existing unified payment framework for token creation,” says Jain.

Also read | Stick with short-term debt funds and bank FDs, for now 

What is tokenisation? 

Tokenisation replaces a debit or credit card’s 16-digit number with a unique token that is specific to just your card and specific for one merchant at a time. The token masks the true details of your card, so in case there is a data leak from the merchant website, the fraudster cannot misuse the card.

Tokens can be used for online transactions, mobile point-of-sale transactions, or in-app transactions. A token contains no personal information and keeps changing, making it the most secure way to transact.
Sumanta Mandal, Founder, TechnoFino, a platform that tracks the Indian credit card industry, cautions cardholders that although card tokenisation is a very secure method, your payment will still go through even if you enter the wrong CVV.

For instance, if you have saved your credit card token on Amazon, then, even if you enter the wrong CVV during a transaction, your payment will still be successful on entering the OTP. The banks need to look at this issue and resolve it soon.

To know more about the investment ascent in India with the nation’s leading financial pioneers, tune in to the Moneycontrol Mutual Fund Summit, 11th October 2023 in Mumbai, 3.50 pm onwards. Log on here for further details.

Powered by Axis Mutual Fund, Strategic Partner Reliance Industries Limited, Associate Partners HSBC Mutual Fund, Motilal Oswal MF, 360 ONE Mutual Fund, IBM and BNP Paribas.