From 1 July 2022, debit and credit card rules concerning online payments will change for customers across India. This is because the Reserve Bank of India is set to implement the credit card and debit card tokenisation rule whereby online merchants will not be allowed to store customer data on their servers to protect their privacy. This includes debit or credit card number, CVV, card expiration date and other sensitive information. 

What is Debit Card, Credit Card Tokenisation?

Tokenisation refers to replacing actual card details with an alternate code called the "token". This shall be unique for a combination of card, token requestor and device.

Steps involved in tokenisation

Step 1: Go to your favourite or most frequently used online website or mobile application to purchase items, including food, grocery or clothes and then initiate a transaction.

Step 2: Select the credit card or debit card payment option when it leads to the checkout page. Now provide the CVV details.

Step 3: Click on the option that says "Secure your card" or "Save card as per RBI guidelines"

Step 4: Click on save and enter the OTP received on your mobile number.

Step 5: Your credit or debit card is now successfully tokenised and is secured. Merchants will not be able to access your information anymore.

The tokenisation system is free of charge and is not mandatory as well. However, it provides a smoother payment experience while securing your data. Tokenisation is only applicable to domestic online transactions.

The registration for a tokenisation request is done only with explicit customer consent through Additional Factor of Authentication (AFA) and not by a forced or automatic selection of check box, radio button, etc., as per the RBI. The customer will also be given the choice of selecting the use case and setting limits.

The central bank mandated the adoption of card-on-file (CoF) tokenisation applicable to domestic online purchases. The countrywide adoption of card tokenisation deadline was extended by six months from 1 January to 1 July 2022 to ensure a smooth shift from the current situation.

What Happens if You Do Not Tokenise Your Card?

The debit card and credit card tokenisation process is not mandatory, and a customer can choose whether or not to let their card be tokenised. In that case, the customer will have to re-enter all card details while purchasing anything online.