Card tokenization all ready to go?

Card tokenization 

The frequency of digital transactions in India have increased exponentially over the years.  Banks are adding more and more technological innovations to their product offerings with a view to help customers with frictionless online journeys. However, as the number and volume of digital transactions increase, so does the number and severity of online fraud including theft and misuse of debit and credit card data. The Reserve Bank of India (RBI) has been concerned about increasing instances of theft and fraud in payment transactions for a long time now. Measures to address this and protect customers and a card users has resulted in the recent  mandate for the adoption of card-on-file (CoF) tokenization by 30th June 2022, meaning merchants, payment aggregators, payment gateways and acquiring banks can no longer store the card details of customers in their server. 

What is Card Tokenization?

Tokenization is the process of replacing or masking the 16 digit card number to an alternative unique code called “token”. The card issuing networks like Visa, Mastercard or RuPay can issue tokens on request on behalf of the card-issuing banks or companies. There are two type of tokens that can be issued: 

1. i) Format preserving tokens – these consist of a 16 digit number but not as same as the original card number
2. ii) Non-format preserving tokens- this format consists of alpha-numeric characters

How does tokenization work? 

When buying a product from online e-commerce platforms like Amazon or Flipkart using either your debit or credit cards, you proceed to the payment section normally by pressing the `Buy’ button followed by filling in the card details. At this stage, going forward, you , as the customer, can opt for tokenization. Your merchant will forward your card details to the respective card network operators. The network then generates a unique token for your card and that is returned to the platform. This token then can be saved on that particular website and be used for your purchases.

What are the benefits of Card Tokenization?

• Ensuring  secured transactions for customers – The tokens generated will be unique for different platforms i.e., a “merchant site specific token”.  In other words, an SBI debit card tokenized in Amazon will have a different token in Flipkart. This will reduce the probability of your card getting hacked even if the online site is under a cyber attack.
• Making platforms safe and secure – Merchants can build trust among the customers by providing them a safe and secure payment gateway. The cost associated with data breach is quite high and companies can reduce it by using a token instead of card details. 

Is the Indian payment ecosystem on track to meet the tokenization deadline set by the RBI? 

• Infrastructure woes- According to the Merchants Payments Alliance of India (MPAI)  the backend infrastructure is not ready to create tokens and process payments simultaneously. Fintech giants including Razorpay,  PayU and Phonepe have adopted tokenization to help their merchants. Paytm has tokenized 2.8 crore cards across Visa, Mastercard and Rupay. These players  consider tokenization as a positive move in the long run.
• Operational bottlenecks –  Adopting tokenization also means that merchants and other entities should purge all card data currently stored in their systems and apply tokenization. Many merchants have also raised concerns about how tokenization will impact their business due to lack of clarity on how instant discount offers and refund processes will be carried out. The lack of preparedness and infrastructure support from card networks can hit the merchants’ revenue. Small scale merchants reportedly are facing hurdles in migrating to the new system and in turn their customers are expected to run into teething problems in the short run.  

However, with less than a month to go for RBI’s new card data storage norms to kick in, the ecosystem is better prepared and generally optimistic in adapting to the change. However, the transition to the new regime may not be entirely seamless as some teething problems may crop up in the initial days, given how complex the implementation process is.