Attention HDFC card holders! Your HDFC Bank card details saved on Merchant Website/App will get deleted by the merchants as per the Reserve Bank of India (RBI) mandate for enhanced card security. This means to make any kind of online transactions, you will have to enter full card details or opt for tokenisation. According to RBI mandate starting January 1, 2022, clear card number, CVV and Expiry date and any other sensitive information related to cards cannot be stored by merchants for processing online transactions.Also Read - Holiday List: Banks To Remain Closed On These Days Next Week | Check Full List Here
Tokenisation refers to replacement of actual or clear card number with an alternate code called the “Token”. This shall be unique for a combination of card, token requestor (i.e. the entity which accepts request from the customer for tokenisation of a card and passes it on to the card network to issue a corresponding token) and the merchant (token requestor and merchant may or may not be the same entity). Also Read - RBI Lifts Restrictions on HDFC Bank's 'Digital 2.0' Plan. Details Here
Once created, the Tokenised card details will be used in place of an actual card number for future online purchases initiated or instructed by the card holder. Also Read - Bank Customer Alert: HDFC Bank Increases Interest Rates on Fixed Deposits. Revised Rates Here
A tokenised card transaction is considered safer as the actual card details are not shared / stored with the merchants to perform the transaction.
Step 1 – The card holder can get the card tokenised by initiating a request on the website/app provided by the token requestor and any such similar facility provided by the merchant.
Step 2 – The token requestor / merchant will forward the request directly to the Bank which issued the applicable credit card or to Visa / Mastercard / Diners / Rupay, with the consent of the card issuing Bank.
Step 3 – The party receiving the request from Token requester, will issue a token corresponding to the combination of the card, the token requestor, and the merchant.
Yes, Starting 1st Jan 2022, both Debit and Credit cards have to be Tokenised
No. Tokenisation is applicable only for Domestic transactions.
Bank will provide a portal to the card holders to view and manage the tokenised cards. Card holders can view / delete tokens for the respective cards through this portal.
Will tokenisation have any impact on the POS transactions that the card holder does at merchant outlets?
No. Tokenisation is only required for carrying out the online transactions
The customer need not pay any charges for availing the service of Tokenising the card.
Tokenisation and de-tokenisation can be performed only by the card issuing Bank or Visa / Mastercard / Rupay / Diners who are referred as authorised card networks.
Ans. Actual card data, token and other relevant details are stored in a secure encrypted mode by the card issuing Bank and / or authorised card networks. Token requestor / merchants cannot store full card number or any other card detail.
No, a customer can choose whether or not to let his / her card tokenised. If not Tokenised, starting 1st Jan 2022, the card holder must enter the full card number, CVV and Expiry date every time to complete their online transactions.
The registration for a tokenisation request is done only with explicit customer consent through Additional Factor of Authentication (AFA), and not by way of a forced / default / automatic selection of check box, radio button, etc. Customer will also be given choice of selecting the use case and setting-up of limits.
A customer can request for tokenisation of any number of cards to perform a transaction.
For performing any transaction, the customer shall be free to use any of the cards registered with the token requestor/merchant.
The customer will see the last 4 digits of the card on the merchant page
The customer should again visit the merchant page and create a fresh token.
Yes. A token must be unique to the card at a specific merchant. If the customer intends to have a card on file at different merchants, then tokens must be created at all the merchants.
Yes. As mentioned earlier, token must be unique for a combination of card and merchant.
Based on risk perception, etc., card issuers may decide whether to allow cards issued by them to be registered by a token requestor / merchant.