Post Tokenisation - is India cut off from the global payments universe?

The card payment industry is highly prone to losing the cardholder's sensitive data while the data transmission process during card payments. According to RBI regulations, no entity in the card transaction or payment chain can store customers' data other than the card issuers and card networks. Payment aggregators (such as Cashfree Payments) have to use network tokens for payment processing instead of the actual credit or debit card number.

Tokenisation is the process designed to improve security and reduce fraud. The token system replaces sensitive payment information, such as credit card number, expiration date, or service code, with unique tokens having no meaning. For example, if you tokenise a customer's name, like "Mohan", it gets replaced by a code like "O10YT6". These tokens represent the actual card details that can be used for card transactions but are useless for hackers.

RBI tokenisation regulations are likely to affect merchants whose business is based in India and mainly have customers within India using domestic debit or credit cards. If businesses do not operate in India and are consequently not supported by India-based payment service providers like Cashfree Payments, tokenisation of card information is not required. The inability to follow the RBI tokenisation regulations will lead to security non-compliance, which can further attract legal action against the merchant or online retailer.

When a customer reaches the online payment gateway (either at a POS terminal or through an online checkout form) and enters card details in the respective fields, the card details reach the merchant's bank in a tokenised format. For example, online e-commerce platforms like Amazon, Flipkart, and Myntra won't be allowed to keep your card information as they had in the past. This is because the actual card details are tokenised by the card network (RuPay, Visa, MasterCard, American Express), and the token is forwarded to the merchants (Amazon, Myntra and the like). Whenever a payment is required, the merchant then transmits this token to the card network, which verifies the transaction by comparing it to the saved information. If the card data is authorised, the authorisation confirmation is sent across the card networks to all relevant parties – including the payment processor, payment gateway, merchant, and customer.

Cashfree Payments offers a standardised, interoperable payment infrastructure that can connect different systems and platforms, which enables customers to make payments to merchants in other countries using different payment methods. Cashfree Payments is a fully certified and compliant Token requestor. It supports the tokenisation of credit cards and debit cards and helps process cards issued by all leading card networks.

Businesses using Cashfree's Payment Gateway can use Token Vault to safely tokenise cards issued by all major card networks, including Visa, Mastercard, Paypal, and RuPay. Thanks to this feature, businesses won't have to waste time integrating with several token service providers to tokenise cards and carry out transactions.

Cashfree Payments can help businesses accept and make payments globally as tokenisation enables them to store and transmit payment information across borders securely. The tokenisation facility simplifies accepting international payments and reduces the risk of fraud. Cashfree Payments also provides a wide range of payment methods, allowing businesses to accept payments from customers using different payment methods, regardless of location. While this system has been implemented domestically, it does not cut off India from the global payments universe.

The card payment network or card issuer stores actual card data and token details securely. The card networks issue the tokens, and it doesn't have an expiration date. Tokens expire only when the merchant chooses to delete the same. The token requestor cannot store any of the card details. However, the same token cannot be issued to multiple merchants. Each token is unique to just one card and merchant.

The introduction of tokenisation in India may provide a level playing field for global players to come to India. It means an entry of international players in offering card payment services into the Indian market. They already have been using tokenisation in geographies like the US, which makes it easy for them to enter India and execute the strategy.

(Above mentioned article is a consumer connect initiative, This article is a paid publication and does not have journalistic/editorial involvement of IDPL, and IDPL claims no responsibility whatsoever.)