Can Card Tokenization relieve Cyber Fraud?

A tokenized card transaction is considered safer as actual card details are not shared with the merchant during transaction processing. Actual card data, token and other relevant details are stored in a secure mode by the authorised card networks. From Saturday (October 1), the Reserve Bank of India’s card-on-file (CoF) tokenization norms have kicked in, which aim at improved safety and security of card transactions. This would mean that no payment site or shopping app can store your 16-digit card number and expiry date data from September 30 onwards.

Now, for any purchases done online or through mobile apps, merchants, payment aggregators and payment gateways will not be able to save crucial customer credit and debit card details such as three-digit CVV and expiry date. This is the same technology that helps keep digital wallet services such as Apple Pay, Google Pay, and Samsung Pay secure. Tokens can be used online, in stores. All the cardholder has to do is wave their device over the payment terminal or through mobile apps.

Tokenization is a process of converting sensitive data into ‘non-sensitive’ data, known as “tokens”. These tokens convert the debit or credit card holder’s 16-digit account number into a digital credential that cannot be stolen or reused. With the help of this token, you can save and transact from any site. There is also no risk of fraud or tampering with it.

A debit or credit card holder can get the card tokenized by initiating a request on the app provided by the token requester. The token requester will forward the request to the card network which, with the consent of the card issuer, will issue a token corresponding to the combination of the card, the token requester, and the device.

In case of an online transaction, instead of card details, a unique token will be stored on the server. The merchant or transaction platform sends out a message to Visa or Mastercard or a payment gateway, who asks for a token against that card number and will then pass it on to the bank for allowing the transaction. However, the customer will not be charged for availing the tokenization service.

Tokenization reduces fraud and makes it easy to replace payment data in case of a lost or stolen mobile device. The card issuer doesn’t need to reissue another card because the number itself is not stored on the phone. All that’s been “lost” is the token and that can be reissued right away, without having to change the account number or issue another physical credit card.

Dr. Deepak Kumar Sahu, President & CEO, VARINDIA