Tokenization will compensate for gaps in PCI-DSS

Chitrabhanu K G, VP & Country Head, Retail Assets & Cards, Federal Bank provides insightful views on the tokenization and its implications for various stakeholders:

Mehul Dani: What is the preparedness expected from the banks?

Chitrabhanu K G: In the present scenario, online payment services like recurring transaction require card details for payment to be initiated on a regular interval/ save the card details of the customer at the merchant portal. Keeping the card details in the merchant site has the risk of cyber frauds. In case the customer decides not to save the card details in the merchant site, he may need to enter the details for each of his transaction and hence this affects his convenience while shopping online.

Tokenization is an encrypted way to save the card details on e-commerce website. Implementation of tokenization will enhance security of stored card details while reducing the risk of data breaches. The encrypted number will be decrypted at bank’s side once the network forwards the requirement. As there are multiple stakeholders involved in the process, the bank’s part will be to process the tokenized transactions.

What will be the process of tokenization and its implications on the industry? How your customer base will be impacted with the tokenization?

Stakeholders involved in a tokenized transaction are customer, merchants, acquirer bank, card payment network, token requester and issuer bank and hence all the parties need to be ready to provide this service. One of the most critical legs in tokenization is after the card gets tokenized and the card details stored at the merchant site gets deleted, the banks should be ready to process the transactions. We have built the capabilities for processing tokenized transactions in co-ordination with Visa, MasterCard and Rupay. This has helped us to increase our technical capabilities over a short period of time.

Customers are the focal point i n electronic cash space. We must make sure that we are protecting all the customer data from exponentially increasing cyber frauds

Chitrabhanu K G insists to ensure protecting all the customer data from exponentially increasing cyber frauds in India

in India. With the implementation of tokenization, customer card details will not be saved on websites. Even if the website gets hacked by fraudsters, the card details won’t be compromised thus ensuring any chance of a financial loss for the customer.

How are retailers, your customers looking at the shift? Is your capex, opex being impacted?

All the customers, who have been issued debit/credit card, will be impacted once the new process is rolled out. We have around 8 million customers who may have an impact due to this process change. Once the customers are informed about the benefits of this new process, most of them will be happy to go the extra mile in meeting these guidelines. The bank is looking at educating the customers on the benefit of tokenization thus ensuring a seamless transition to the new system. With regard to cost aspects, this is not expected to be very high.

How the end customers stand to gain by tokenization as part of the important stakeholders in the digital payments space?

A normal transaction will be flowing from the merchant through acquirer to the card networks and then to the issuer bank for approval. The security of data transmission between networks and issuer banks are normally strong as most banks follow PCIDSS guidelines. The transmission of card data from merchant to card network is where the risk of data leakage is more as most merchants cannot afford to comply with PCI (Payment Card Industry) DSS (Data Security Standard) guidelines. The only available option for merchants is to tokenize and save the card details for which they require integration with token service providers. Initially, 3 months’ time was mandated by RBI for implementation of this new process. While big merchants and banks may be able to complete the same within this period, this was expected to impact small merchants. Our bank is already ready. But unless the entire ecosystem gets ready to for the new process, the model will not work seamlessly. Hence, we welcome the decision from RBI to extend the period of implementation by another 6 months so that all the merchants get ready.