Indian online merchants cannot store credit card information from 2022

Recurring payment for less than 5000Rs do not require a separate auth. The bank has to notify the user by sending a message.

Recurring payment greater than 5000Rs requires a separate auth. (EMI's are not impacted by this)

Yes. But the reply above was regarding how recurring payments would work

Is the RBI deliberately trying to handicap credit cards in India? The decision to make recurring payments impossible, followed by having to enter card information every time I do an online transaction is making for a very frustrating experience.

The justification for these decisions is always "consumer interest" but how is making consumers jump through hoops to do transact online in consumer interest? I wish the industry was more co-ordinated in lobbying against these crazy policies

Edit: A couple of replies below that say they don't mind authorizing subscriptions/recurring charges every time. I respect that view but I think people underestimate how much friction it adds if a business needs to ask your for permission every time to renew. Consumers are forgetful. They may not be available to authorize a payment when it's time to renew. Subscriptions reduce transaction costs, give businesses a predictable stream of income and allow consumers continued access to services without having to remember to renew it.

If you don't believe me, just look at the data and anecdotes posted by tech journalists and software devs on twitter - it's a shitshow.

If a businesses make cancellation hard, the right policy would have been to allow consumers to "stop" charge from the card issuer's website or app - not ask consumers to approve a charge everytime it happens.

I would love to be able to have to proactively authorize every single recurring purchase via a tap on my phone. If I have enough that I’m being overwhelmed there’s a good chance I’m not tracking my purchases very well and there could even be fraud I’m missing.

There’s some use-cases maybe where automatic billing is required but the vast majority would do better to need to prompt the user.

This is actually a good thing. Think of it like Apple's email masking service - Merchants can only store a tokenized version of your credit card instead of the real card details. I say this is a good thing after having worked with many E-Commerce shops in India as a consultant. Most of them barely know a thing about security, let alone about PCI DSS compliance.

I have worked with shops that stored the entire credit card number in PLAIN TEXT!. Not just credit cards, even their users' passwords. This also explains why many of them got and still get hacked from time to time. Even credit card processors got hacked due to this. Lot of shitty ones in the Indian market actually.

The root cause of this, not to cause language flame wars here, but is most of the shops use script kiddos with just basic PHP knowledge. Bare minimum, they're recent fresh college grads who just know how to consume data from a form using PHP using GET and POST, that's it. Most of the code I've worked with just consumes this directly instead of stripping/processing it and end up introducing SQL injection attacks. Atleast, if they used a framework, this would be provided by default for free, but many of the developers hardly know about even MVC.

(As an aside) - As a personal mission, I started touring around the country teaching college kids for free about basics of web development, security, etc. But, still, I have a long way to go.

Well folks, that's it for today's note on why this was a good move. Have a nice day!

Edit: Some of the recent hacks that were not made public widescale like they should've been:

1. Domino's Pizza India (Yes, the international pizza chain)

2. BigBasket (Largest online grocery ordering App)

3. PayTm (One of the largest, if not the largest digital payments app in India)