Hacker News Reader

Comment by _hyn3 | Hacker News Reader

How would recurring transactions or metered billing work? Does this only apply to merchants or providers that are not PCI-DSS compliant and cannot safely store cardholder data?

View on HN

The headline is kinda misleading. They can store credit card information, but they can only do that in tokenized format instead of the current way of storing. Tokenized format hides the number and other information making it more secure. You can read more about it here https://www.thequint.com/explainers/rbi-allows-card-on-file-...

The token is a random number, so depending on context it's fair to say that the token is not credit card information.

Yes. But the reply above was regarding how recurring payments would work

I'm not sure how that affects my reply.

To be clear, I am commenting on the difference between:

"Recurring payments work by storing credit card info in tokenized form, which is still allowed".

vs.

"Recurring payments work by storing a token instead of credit card information."

Those both answer the question, but they say different things on whether "credit card information" is stored. And they say different things about whether the headline is misleading.

To use card tokens for any kind of payment, you need to integrate with some kind of card data vault, which this rule seems to also prohibit. It seems to be instructing the card brands to issue unique tokens for ever cardholder + merchant pair. No idea how that would work…

> To use card tokens for any kind of payment, you need to integrate with some kind of card data vault, which this rule seems to also prohibit.

Why would you need that?

The rule says nobody can store "actual card data".

If you're using the token for a new payment, you don't retrieve the card number, you use the token directly.

> It seems to be instructing the card brands to issue unique tokens for ever cardholder + merchant pair. No idea how that would work…

Pick a random number and store it in a database with those two other fields...?

That number needs to be mapped to the PAN, and somebody has to have stored that PAN somewhere in order for it to be used to process payment. This rule says nobody other than the issuer and the card brands are allowed to store the PAN.

Sure, that's why you get the token from the issuer or card brand. That way there's only one entity that stores the PAN, and no third parties are storing it.

To quote the article linked above, "The central bank said the facility of tokenisation shall be offered by TSPs only for the cards issued by/affiliated to them."

There is no exception for recurring payments. Also unfortunately this applies to all online merchants and Payment aggregators regardless of size and certifications. So as it stands a separate auth is needed for each transaction which is completely regressive and precludes a lot of convenience use cases. My guess is that they are doing this to make Upi more convenient in comparison. But I won't be surprised if its just another short sighted we know it all mentality decision from the regulator who has a history of u-turns.

Edit: Looks like they do allow card tokenization (not part of original proposal) which should address a lot of use cases

Here is the commentary about the original proposal:

https://www.businessinsider.in/finance/banks/news/rbi-wants-...

Here is the one after push back from industry (Which allows tokenization):

https://timesofindia.indiatimes.com/business/india-business/...

Recurring payment for less than 5000Rs do not require a separate auth. The bank has to notify the user by sending a message.

Recurring payment greater than 5000Rs requires a separate auth. (EMI's are not impacted by this)

This change just says that only the card issuer or card network can store the card number (PAN). Everyone else in the processing chain can only store card tokens.

This isn’t a surprising change and was always going to be the future of PCI compliance.

Any card details that are being stored in the merchant's database need to be tokenised. It applies to all entities who are retrieving card details from customers, irrespective of PCI/DSS compliance.

I have already lost my online book store: "perlego" subscription because of this. This is has 100% directly stopped my access to learning. There is no other way to put it.

couldn't credit card companies expose an API to let you do this?

Reply on news.ycombinator.com