Last week, the Reserve Bank of India released new guidelines on tokenizing card transactions.
Previously, the bank had allowed tokenization in certain cases, it said. It is now allowing the practice for all use cases – including near-field communication (NFC), in-app payments and QR code-based payments – conducted using mobile phones or tablets.
Tokenized transactions use a unique number – known as a token – to represent a card number, reducing the risk of fraud from real card information being stolen.
The new guidelines allow card networks to offer tokenization services to third party providers that request them, the bank said. They require transaction acquirers to continue using all other required security protocols, such as multifactor authentication, when and where they’re mandated.
“These guidelines permit authorized card payment networks to offer card tokenization services to any token requestor (third party app provider), subject to conditions enumerated in these guidelines,” RBI Chief General Manager Jose J. Kattoor wrote in the bank’s announcement. “A card holder may avail of these services by registering the card on the token requestor’s app after giving explicit consent.”
The Hindu Business Line quoted a statement from Mastercard praising the new guidelines.
“The move is also in line with the Digital India agenda, and exemplifies the efforts by the regulator to decrease fraud. We expect this move to increase the share of digital payments in everyday use-cases – grocery, fuel and transit,” the statement said.
In addition to increased security, the new direction from the country’s central bank also has the potential to help develop future payments technology innovation, according to an article in ETTech.
“It could also help in developing the next generation of contactless point of sales (PoS) terminals which can read transactions from smartphones or any other devices,” Rajeev Agrawal, chief executive officer at Innoviti Payments, told the publication. “For a start, terminals will not need to print a confirmation slip since transactions originating from a device will get confirmation in soft copy there itself.”
Innoviti operates as a payment facilitator.
The RBI said that the ability to use tokenization on devices other than mobile phones and tablets will be considered later based on what is learned from this step.