Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Indian online merchants cannot store credit card information from 2022

rbi.org.in

Post reply on HN
Print view View original

21–30 of 157 posts

Re: Indian online merchants cannot store credit card information from 2022

#21

Post by Dylan16807 »

AmericanChopper wrote: post #16
Dylan16807 wrote: post #14

Earlier quoted context omitted.

I'm not sure how that affects my reply. To be clear, I am commenting on the difference between: "Recurring payments work by storing credit card info in tokenized form, which is still allowed". vs. "Recurring payments work by storing a token instead of credit card information." Those both answer the question, but they say different things on whether "credit card information" is stored. And they say different things ab…

To use card tokens for any kind of payment, you need to integrate with some kind of card data vault, which this rule seems to also prohibit. It seems to be instructing the card brands to issue unique tokens for ever cardholder + merchant pair. No idea how that would work…

> To use card tokens for any kind of payment, you need to integrate with some kind of card data vault, which this rule seems to also prohibit.

Why would you need that?

The rule says nobody can store "actual card data".

If you're using the token for a new payment, you don't retrieve the card number, you use the token directly.

> It seems to be instructing the card brands to issue unique tokens for ever cardholder + merchant pair. No idea how that would work…

Pick a random number and store it in a database with those two other fields...?

Re: Indian online merchants cannot store credit card information from 2022

#22

Post by ramraj07 »

blueblisters wrote: post #15

Is the RBI deliberately trying to handicap credit cards in India? The decision to make recurring payments impossible, followed by having to enter card information every time I do an online transaction is making for a very frustrating experience. The justification for these decisions is always "consumer interest" but how is making consumers jump through hoops to do transact online in consumer interest? I wish the indu…

As a consumer in India I’m so happy at least some part of this government is doing what it’s supposed to do.

A century of unchecked lobbying is pretty much the reason why the US is at the state it is. The difference I’ve seen between how things run in india and the states is that in India what’s illegal and called corruption is called legal and lobbying here.

What exactly are you worried about ? Clicking authorize on nytimes subscription every month?

Re: Indian online merchants cannot store credit card information from 2022

#23

Post by rg111 »

vivekv wrote: post #3
teleforce wrote: post #2

Kudos to Indian govt, this should be the default for any e-commerce websites. I have to resort to PayPal to avoid my credit card being stored in the e-commerce merchant sites but some of sites do not support PayPal. It seems that Amazon somehow would not even allow me to delete my old and expired credit card from my account.

Indian merchants have to support UPI - another payment mechanism which is secure. I tend to use that in most places so that I dont have to store my card details.

Do you have to use your cellphone number to avail UPI services?

If that is the case, then it is not for me.

Re: Indian online merchants cannot store credit card information from 2022

#24

Post by illegalmemory »

rg111 wrote: post #23
vivekv wrote: post #3

Earlier quoted context omitted.

Indian merchants have to support UPI - another payment mechanism which is secure. I tend to use that in most places so that I dont have to store my card details.

Do you have to use your cellphone number to avail UPI services? If that is the case, then it is not for me.

I have created UPI ID directly with bank and there is no need of any third party app. It can be used to transfer money directly without sharing bank and card details.

Re: Indian online merchants cannot store credit card information from 2022

#25

Post by charcircuit »

_hyn3 wrote: post #4

How would recurring transactions or metered billing work? Does this only apply to merchants or providers that are not PCI-DSS compliant and cannot safely store cardholder data?

couldn't credit card companies expose an API to let you do this?

Re: Indian online merchants cannot store credit card information from 2022

#26

Post by echlipse »

rg111 wrote: post #23
vivekv wrote: post #3

Earlier quoted context omitted.

Indian merchants have to support UPI - another payment mechanism which is secure. I tend to use that in most places so that I dont have to store my card details.

Do you have to use your cellphone number to avail UPI services? If that is the case, then it is not for me.

You need to have a bank account to use UPI. Banks require a phone number afaik.

Re: Indian online merchants cannot store credit card information from 2022

#27

Post by noduerme »

So, in the early days of online retail, I built shopping carts that stored credit card numbers in the business's database and connected directly with a credit card gateway (not a provider like Stripe). By around 2006 it became clear that this was insanely dangerous to do. Every merchant could not be storing a database of their customers' credit card numbers. I don't know if it's actually illegal to do online card processing this way in the US now, but no card company would work with you if you did.

So my takeaway from this is that, the fact that card companies are still accepting "card not present" style transactions from online retailers in India means they have been willing up to this point to tolerate a large amount of fraud and hacking in order to tap the market. The logical next step for them is to limit the number of data sources storing the card numbers and customer data themselves. Whether this comes in the form of a government decree or the slow moving of the card companies away from accepting these kinds of transactions, the change is inevitable. Local hosting and locally managed databases are no place for credit card numbers to be stored.

Re: Indian online merchants cannot store credit card information from 2022

#28

Post by adi2907 »

blueblisters wrote: post #15

Is the RBI deliberately trying to handicap credit cards in India? The decision to make recurring payments impossible, followed by having to enter card information every time I do an online transaction is making for a very frustrating experience. The justification for these decisions is always "consumer interest" but how is making consumers jump through hoops to do transact online in consumer interest? I wish the indu…

As an entrepreneur, I empathise with fellow startups losing customers due to mandatory check for recurring payments. However as a customer, this has been a godsend as I had almost 15 subscriptions totalling $300 monthly, quite a large amount in India.

The constant reminder of how many of those subscriptions are useless has allowed me to cut my expenses. Case in point, was subscribed to linkedin premium for last 2 years, while I make use of it only once in 3-4 months. Now I simply dont recharge my credit card and only do so once its required.

Not sure if its the ideal solution but definitely am thankful to it!

Re: Indian online merchants cannot store credit card information from 2022

#30

Post by paxys »

neya wrote: post #19

This is actually a good thing. Think of it like Apple's email masking service - Merchants can only store a tokenized version of your credit card instead of the real card details. I say this is a good thing after having worked with many E-Commerce shops in India as a consultant. Most of them barely know a thing about security, let alone about PCI DSS compliance. I have worked with shops that stored the entire credit c…

That's a weird generalization. Yes there are terrible, insecure e-commerce sites in India, the same as there are in the USA and everywhere else on the planet. India is also the top 7-8 e-commerce market in the world. Large local apps in the space have valuations in the tens of billions of dollars, and all major global players like Amazon and Walmart are involved in the country as well. These $100B in annual sales aren't processed by script kiddies, it's a very large and mature industry.
Post reply on HN