Card on File (CoF) Tokenisation

Why in news?

• The Reserve Bank of India (RBI) has introduced new channels for card on file for tokenisation. Now it will be issued at bank-level to enhance convenience to create tokens.

About Card on File Tokenisation

• Card on File (CoF) tokenization is a security practice used in the field of payment processing and financial transactions. It involves replacing sensitive credit card information (such as the card number, expiration date, and security code) with a unique token or reference number.
• RBI introduced Card-on-File Tokenisation (CoFT) in September 2021 and began implementation from October 1, 2022.
• Until now, the cardholders had to create different tokens through each merchant’s application or webpage. This would require time and effort from the users. Going forward, tokens will be created at the issuer bank level and linked to their existing accounts with various e-commerce applications. This will eliminate the duplication of tokenisation process at each app or website along with increased transaction security.
• In India, tokenization is applicable only for domestic transactions.
• A customer can request for any number of cards to get tokenised; there’s no limit on the maximum number of cards.

How it works?

• When a customer makes a payment for a service or product and chooses to store their card information for future transactions, the merchant or payment processor securely stores the card data in a highly protected environment.
• Instead of storing the actual card data, a tokenization system generates a token or reference number, which is a randomly generated sequence of characters. This token is associated with the customer’s card data but doesn’t contain any sensitive information.
• The token is then linked to the customer’s account or profile with the merchant or payment service provider.
• For subsequent transactions, the customer can use the token instead of providing their full card details. The token is sent to the payment processor or merchant, which can then look up the associated card data in their secure storage.

PRACTICE QUESTION:

Consider the following statements regarding Card on File for tokenisation in India:

1. In India, tokenization is applicable only for domestic transactions.
2. A customer can request for only one card to get tokenised.

Which of the statements given above is/are correct?

(a) 1 only

(b) 2 only

(c) Both 1 and 2

(d) Neither 1 nor 2

Answer