Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Indian online merchants cannot store credit card information from 2022

rbi.org.in

Post reply on HN
Print view View original

101–110 of 157 posts

Re: Indian online merchants cannot store credit card information from 2022

#101

Post by randombits0 »

neya wrote: post #19

This is actually a good thing. Think of it like Apple's email masking service - Merchants can only store a tokenized version of your credit card instead of the real card details. I say this is a good thing after having worked with many E-Commerce shops in India as a consultant. Most of them barely know a thing about security, let alone about PCI DSS compliance. I have worked with shops that stored the entire credit c…

I’m a PCI QSA and this is exactly correct. No one should store card data for recurring transactions. India just made it a law. Good for them.

Re: Indian online merchants cannot store credit card information from 2022

#102

Post by txtsd »

neya wrote: post #19

This is actually a good thing. Think of it like Apple's email masking service - Merchants can only store a tokenized version of your credit card instead of the real card details. I say this is a good thing after having worked with many E-Commerce shops in India as a consultant. Most of them barely know a thing about security, let alone about PCI DSS compliance. I have worked with shops that stored the entire credit c…

How do I get these firms to hire me instead? I know enough about the basics of security to not make these mistakes. Why would they choose college grads who know nothing about it instead?

Re: Indian online merchants cannot store credit card information from 2022

#103

Post by usr1106 »

pronlover723 wrote: post #71
teleforce wrote: post #2

Kudos to Indian govt, this should be the default for any e-commerce websites. I have to resort to PayPal to avoid my credit card being stored in the e-commerce merchant sites but some of sites do not support PayPal. It seems that Amazon somehow would not even allow me to delete my old and expired credit card from my account.

paypal is worse than credit card for me. For one the paypal always shares your paypal email address where as when I pay with credit card I always give a different email address to every merchant.

Why I needed to change the email address I use for paypal repeatedly. Now I have mostly stopped to use paypal. It's full of dark patterns like making authorization recurring without giving me an option. Need to cancel authorization for future payments manually afterwards. I guess in the wost case this could be racy, another payment before I cancel.

Re: Indian online merchants cannot store credit card information from 2022

#104

Post by the_other »

txtsd wrote: post #102
neya wrote: post #19

This is actually a good thing. Think of it like Apple's email masking service - Merchants can only store a tokenized version of your credit card instead of the real card details. I say this is a good thing after having worked with many E-Commerce shops in India as a consultant. Most of them barely know a thing about security, let alone about PCI DSS compliance. I have worked with shops that stored the entire credit c…

How do I get these firms to hire me instead? I know enough about the basics of security to not make these mistakes. Why would they choose college grads who know nothing about it instead?

Cost.

Re: Indian online merchants cannot store credit card information from 2022

#105

Post by nmstoker »

the_other wrote: post #104
txtsd wrote: post #102

Earlier quoted context omitted.

How do I get these firms to hire me instead? I know enough about the basics of security to not make these mistakes. Why would they choose college grads who know nothing about it instead?

Cost.

It's really cost plus a chance they'll get away with it (or the team/mgr hiring will have moved on by the time it's found out).

If it were cost but they were guaranteed to get caught they wouldn't do it.

Re: Indian online merchants cannot store credit card information from 2022

#106

Post by LeonM »

txtsd wrote: post #102
neya wrote: post #19

This is actually a good thing. Think of it like Apple's email masking service - Merchants can only store a tokenized version of your credit card instead of the real card details. I say this is a good thing after having worked with many E-Commerce shops in India as a consultant. Most of them barely know a thing about security, let alone about PCI DSS compliance. I have worked with shops that stored the entire credit c…

How do I get these firms to hire me instead? I know enough about the basics of security to not make these mistakes. Why would they choose college grads who know nothing about it instead?

The issue is often that:

1. The vendor is not aware that this is a problem 2. As a result of point 1, the vendor does not have budget planned for this. 3. The reward for the investment does not make sense for most of the vendors.

About point 3: For the vendor, there is no tangible improvement in sales (in fact, some security measures raise the barrier for their customers to place an order). So why should they do it? In their experience, the budget is better spent on improving the customer experience, marketing, increasing stock, lowering prices, etc.

Point 3 is really tricky, especially in some cultures and countries. If there is no legal consequence for leaking customer data, why should they be spending money on preventing something that may or may not happen in the future?

Re: Indian online merchants cannot store credit card information from 2022

#107

Post by seesawtron »

teleforce wrote: post #2

Kudos to Indian govt, this should be the default for any e-commerce websites. I have to resort to PayPal to avoid my credit card being stored in the e-commerce merchant sites but some of sites do not support PayPal. It seems that Amazon somehow would not even allow me to delete my old and expired credit card from my account.

>It seems that Amazon somehow would not even allow me to delete my old and expired credit card from my account. If you are in the EU, in my experience with the GDPR, this is not allowed. The e-commerce merchant must allow users to have the option to remove this information. PS: I had to file a formal complaint against a telecom company to have this resolved.

Re: Indian online merchants cannot store credit card information from 2022

#108

Post by zerocount »

teleforce wrote: post #2

Kudos to Indian govt, this should be the default for any e-commerce websites. I have to resort to PayPal to avoid my credit card being stored in the e-commerce merchant sites but some of sites do not support PayPal. It seems that Amazon somehow would not even allow me to delete my old and expired credit card from my account.

I agree. I had to do the PayPal thing with my Visible phone service because I couldn't delete an old card. Luckily PayPal doesn't require me to have anything linked just to have an account.

Why do companies want to store this data any way?

Re: Indian online merchants cannot store credit card information from 2022

#109

Post by naruvimama »

blueblisters wrote: post #15

Is the RBI deliberately trying to handicap credit cards in India? The decision to make recurring payments impossible, followed by having to enter card information every time I do an online transaction is making for a very frustrating experience. The justification for these decisions is always "consumer interest" but how is making consumers jump through hoops to do transact online in consumer interest? I wish the indu…

Credit cards are from an era where magnetic stripes was a novelty. It is just a bunch of numbers and very lax in security.

Visa & Mastercard are just global duopolies, they have used their dominance to keep the cards easy to use but insecure. The cost of fraud is ultimately borne by the merchants, who try to pass on the hefty fee to the card holders.

India is trying to move to digital payments, a vast majority of the people are first time card holders or even account holders. Frauds do not make it easy, and we do not want to make digital payments more expensive than cash payments.

This is not a move against any card network. However, I personally think it is wrong for Visa/Mastercard to use their market dominance to charge 2-3% of every transaction. As we move more and more into a digital economy, this duopoly starts to sound like a New East India Company.

Re: Indian online merchants cannot store credit card information from 2022

#110

Post by alkonaut »

I always enter my card details (unless direct bank transfer is available, which is becoming pretty popular lyckily).

But I never found the idea that a saved credit card number (23 digits) would make a shopping experience so much convenient than having to enter it. A typical checkout still has me entering my address, choosing between 5 different delivery options, agreeing to various terms and so on. The payment step is just a minor step along the way.

I wonder if this entering of payment info is feeling more inconvenient to people who have become used to not having to do it, for example because they have used Amazon (I still never ordered anything there because they don't have a functioning operation where I live).

Post reply on HN