5 ms·

How would recurring transactions or metered billing work? Does this only apply to merchants or providers that are not PCI-DSS compliant and cannot safely store

by _hyn3 5y ago

How would recurring transactions or metered billing work? Does this only apply to merchants or providers that are not PCI-DSS compliant and cannot safely store cardholder data?

jetsetgo 5y ago
It won't. Like it should be. No one should be able to take your money without your consent.
deleted 5y ago
[deleted]
LammyL 5y ago
This change just says that only the card issuer or card network can store the card number (PAN). Everyone else in the processing chain can only store card tokens. This isn’t a surprising change and was always going to be the future of PCI compliance.
option_greek 5y ago
There is no exception for recurring payments. Also unfortunately this applies to all online merchants and Payment aggregators regardless of size and certifications. So as it stands a separate auth is needed for each transaction which is completely regressive and precludes a lot of convenience use cases. My guess is that they are doing this to make Upi more convenient in comparison. But I won't be surprised if its just another short sighted we know it all mentality decision from the regulator who has a history of u-turns. Edit: Looks like they do allow card tokenization (not part of original proposal) which should address a lot of use cases Here is the commentary about the original proposal: https://www.businessinsider.in/finance/banks/news/rbi-wants-you-to-memorise-all-your-debit-and-credit-card-numbers/articleshow/81186570.cms https://www.businessinsider.in/finance/banks/news/rbi-wants-... Here is the one after push back from industry (Which allows tokenization): https://timesofindia.indiatimes.com/business/india-business/e-tailers-cant-store-your-card-data-says-rbi/articleshow/85581684.cms https://timesofindia.indiatimes.com/business/india-business/...
- mittalsuraj18 5y ago
  Recurring payment for less than 5000Rs do not require a separate auth. The bank has to notify the user by sending a message. Recurring payment greater than 5000Rs requires a separate auth. (EMI's are not impacted by this)
mittalsuraj18 5y ago
The headline is kinda misleading. They can store credit card information, but they can only do that in tokenized format instead of the current way of storing. Tokenized format hides the number and other information making it more secure. You can read more about it here https://www.thequint.com/explainers/rbi-allows-card-on-file-tokenisation-what-is-it-is-it-safer-for-consumers https://www.thequint.com/explainers/rbi-allows-card-on-file-...
- Dylan16807 5y ago
  The token is a random number, so depending on context it's fair to say that the token is not credit card information.
  - planet_1649c 5y ago
    Yes. But the reply above was regarding how recurring payments would work
    - Dylan16807 5y ago
      I'm not sure how that affects my reply. To be clear, I am commenting on the difference between: "Recurring payments work by storing credit card info in tokenized form, which is still allowed". vs. "Recurring payments work by storing a token instead of credit card information." Those both answer the question, but they say different things on whether "credit card information" is stored. And they say different things about whether the headline is misleading.
      - AmericanChopper 5y ago
        To use card tokens for any kind of payment, you need to integrate with some kind of card data vault, which this rule seems to also prohibit. It seems to be instructing the card brands to issue unique tokens for ever cardholder + merchant pair. No idea how that would work…
        5y ago
rohithkp 5y ago
Any card details that are being stored in the merchant's database need to be tokenised. It applies to all entities who are retrieving card details from customers, irrespective of PCI/DSS compliance.
freakynit 5y ago
I have already lost my online book store: "perlego" subscription because of this. This is has 100% directly stopped my access to learning. There is no other way to put it.
charcircuit 5y ago
couldn't credit card companies expose an API to let you do this?

by _hyn3 5y ago

How would recurring transactions or metered billing work? Does this only apply to merchants or providers that are not PCI-DSS compliant and cannot safely store cardholder data?

jetsetgo 5y ago

It won't. Like it should be. No one should be able to take your money without your consent.

deleted 5y ago

[deleted]

LammyL 5y ago

This change just says that only the card issuer or card network can store the card number (PAN). Everyone else in the processing chain can only store card tokens. This isn’t a surprising change and was always going to be the future of PCI compliance.

option_greek 5y ago

There is no exception for recurring payments. Also unfortunately this applies to all online merchants and Payment aggregators regardless of size and certifications. So as it stands a separate auth is needed for each transaction which is completely regressive and precludes a lot of convenience use cases. My guess is that they are doing this to make Upi more convenient in comparison. But I won't be surprised if its just another short sighted we know it all mentality decision from the regulator who has a history of u-turns. Edit: Looks like they do allow card tokenization (not part of original proposal) which should address a lot of use cases Here is the commentary about the original proposal: https://www.businessinsider.in/finance/banks/news/rbi-wants-you-to-memorise-all-your-debit-and-credit-card-numbers/articleshow/81186570.cms https://www.businessinsider.in/finance/banks/news/rbi-wants-... Here is the one after push back from industry (Which allows tokenization): https://timesofindia.indiatimes.com/business/india-business/e-tailers-cant-store-your-card-data-says-rbi/articleshow/85581684.cms https://timesofindia.indiatimes.com/business/india-business/...

mittalsuraj18 5y ago
Recurring payment for less than 5000Rs do not require a separate auth. The bank has to notify the user by sending a message. Recurring payment greater than 5000Rs requires a separate auth. (EMI's are not impacted by this)

mittalsuraj18 5y ago

The headline is kinda misleading. They can store credit card information, but they can only do that in tokenized format instead of the current way of storing. Tokenized format hides the number and other information making it more secure. You can read more about it here https://www.thequint.com/explainers/rbi-allows-card-on-file-tokenisation-what-is-it-is-it-safer-for-consumers https://www.thequint.com/explainers/rbi-allows-card-on-file-...

Dylan16807 5y ago
The token is a random number, so depending on context it's fair to say that the token is not credit card information.
- planet_1649c 5y ago
  Yes. But the reply above was regarding how recurring payments would work
  - Dylan16807 5y ago
    I'm not sure how that affects my reply. To be clear, I am commenting on the difference between: "Recurring payments work by storing credit card info in tokenized form, which is still allowed". vs. "Recurring payments work by storing a token instead of credit card information." Those both answer the question, but they say different things on whether "credit card information" is stored. And they say different things about whether the headline is misleading.
    - AmericanChopper 5y ago
      To use card tokens for any kind of payment, you need to integrate with some kind of card data vault, which this rule seems to also prohibit. It seems to be instructing the card brands to issue unique tokens for ever cardholder + merchant pair. No idea how that would work…
      - 5y ago

rohithkp 5y ago

Any card details that are being stored in the merchant's database need to be tokenised. It applies to all entities who are retrieving card details from customers, irrespective of PCI/DSS compliance.

freakynit 5y ago

I have already lost my online book store: "perlego" subscription because of this. This is has 100% directly stopped my access to learning. There is no other way to put it.

charcircuit 5y ago

couldn't credit card companies expose an API to let you do this?