3 ms·

So the order doesn’t prohibit tokenizing or saving cards, it specifies who can save them. Earlier, merchants could save the details, and this ability leads to

So the order doesn’t prohibit tokenizing or saving cards, it specifies who can save them. Earlier, merchants could save the details, and this ability leads to massive amounts of fraud and theft (see US right now). Then only regulated payment aggregators could save them, and issue a token to the merchants. Stealing the token wasn’t too helpful because you couldn’t grab the money, the token was tied to the merchant. But this still means my card number is stored on a bunch of companies that can suddenly take whatever funds they want, and I can’t cancel these tokens. Fast forward to 2022, where only the issuer I got my card from can give out tokens - so I can now see a list of every single merchant who has access to my card tokens, and I can cancel them whenever I want. So the functionality is not going away, it’s moving to another part of the regulated system that’s more in the control of the consumer. As a person I welcome the move (no more struggling to understand card charges or pleading with companies to cancel my subscriptions). As a developer it’s more work to implement the new system, but it’s not much more work than the old one. Projects using Stripe or Razorpay will get the new system with no changes.

vishnugupta 5y ago
Thanks for clear and jargon-free response. I wish this were top-level and top comment.
sidm83 5y ago
This is a great response throwing light on the actual new protocol which does seem to make sense.
ratww 5y ago
Yep, this is how most of the companies I worked for handled recurring payments. The only time the customer needs to input their credit card again is when the credit card number changes. Some providers even had integration with banks, so when a credit card was auto-renewed and the expiration changed (the CC number was still the same), we didn't even have to ask the customer for an update. Only when the customer specifically asked for a new card. So there's even the possibility of even more convenience to customers.

vishnugupta 5y ago

Thanks for clear and jargon-free response. I wish this were top-level and top comment.

sidm83 5y ago

This is a great response throwing light on the actual new protocol which does seem to make sense.

ratww 5y ago

Yep, this is how most of the companies I worked for handled recurring payments. The only time the customer needs to input their credit card again is when the credit card number changes. Some providers even had integration with banks, so when a credit card was auto-renewed and the expiration changed (the CC number was still the same), we didn't even have to ask the customer for an update. Only when the customer specifically asked for a new card. So there's even the possibility of even more convenience to customers.