Live data from Hacker News

Indian online merchants cannot store credit card information from 2022

rbi.org.in

141–150 of 157 posts

Re: Indian online merchants cannot store credit card information from 2022

#141
post #93
post #19

This is actually a good thing. Think of it like Apple's email masking service - Merchants can only store a tokenized version of your credit card instead of the real card details. I say this is a good thing after having worked with many E-Commerce shops in India as a consultant. Most of them barely know a thing about security, let alone about PCI DSS compliance. I have worked with shops that stored the entire credit c…

I have spent a long time in eComm in the west, and you see that kind of stuff there as well. The most erroneous was the company that would take credit cards in plain text, print them onto an order sheet for reception staff to put through their POS at the front desk, and then the order sheets just went into the bin near the entrance. Thousands of credit card numbers were just sitting there for the taking, in plain tex…

Not just ecomm. I remember the days when customers would read their credit card numbers over the phone for small businesses (e.g. pizza joints). You'd write it down for processing later. The paper then gets disposed of at some point with the full credit card info and name written on them.

Re: Indian online merchants cannot store credit card information from 2022

#142
post #123

Earlier quoted context omitted.

As a consumer in India I’m so happy at least some part of this government is doing what it’s supposed to do. A century of unchecked lobbying is pretty much the reason why the US is at the state it is. The difference I’ve seen between how things run in india and the states is that in India what’s illegal and called corruption is called legal and lobbying here. What exactly are you worried about ? Clicking authorize on…

> Clicking authorize on nytimes subscription every month? Why is that a good thing?

Why is it bad?

One of the first pieces of advice for anyone sorting out personal finances is "figure out what subscriptions you aren't using." Cancelling in many cases is an anti-pattern (looking at you, NYT)

Re: Indian online merchants cannot store credit card information from 2022

#143

Pardon me if I’m incorrect, but isn’t this like one of the best use cases of Stripe? Stripe usually takes care of CC/ACH information and tokenizes it, only passing the tokens to the merchant instead of the merchant having to store the CC information. Maybe this would be a good way to start a payments company boom in India?

There are already several (razorpay, paytm, payu) that do exactly that. They do charge 2% flat fee which is still high by Indian standards (comparing to cash and upi). So merchants do try custom solutions with bank gateways to reduce the fee.

Re: Indian online merchants cannot store credit card information from 2022

#144
post #19

This is actually a good thing. Think of it like Apple's email masking service - Merchants can only store a tokenized version of your credit card instead of the real card details. I say this is a good thing after having worked with many E-Commerce shops in India as a consultant. Most of them barely know a thing about security, let alone about PCI DSS compliance. I have worked with shops that stored the entire credit c…

> (As an aside) - As a personal mission, I started touring around the country teaching college kids for free about basics of web development, security, etc. But, still, I have a long way to go.

Kudos for doing God's work! As someone who studied in India, I think youtube videos might have a better reach with Indian student audience. There is so many mediocre content out there on YouTube and high-SEO sites like GFG (they are kinda fine for algorithm / Leetcode stuff but I can't stand their student-contributed code for anything else). A higher quality de-facto tutorial series might make a better impact. But of course promoting is important.

Re: Indian online merchants cannot store credit card information from 2022

#145

Is the RBI deliberately trying to handicap credit cards in India? The decision to make recurring payments impossible, followed by having to enter card information every time I do an online transaction is making for a very frustrating experience. The justification for these decisions is always "consumer interest" but how is making consumers jump through hoops to do transact online in consumer interest? I wish the indu…

Credit cards are from an era where magnetic stripes was a novelty. It is just a bunch of numbers and very lax in security. Visa & Mastercard are just global duopolies, they have used their dominance to keep the cards easy to use but insecure. The cost of fraud is ultimately borne by the merchants, who try to pass on the hefty fee to the card holders. India is trying to move to digital payments, a vast majority of the…

You should know that a small portion of the 2-3% transaction fees goes to the card networks. Most goes to the card issuing bank. Now in fairness, the banks also cover the cost of some fraud, and payout generous rewards to their best customers.

Re: Indian online merchants cannot store credit card information from 2022

#146

Earlier quoted context omitted.

Yes, some basis exists for such assumptions. RuPay and UPI were originally conceptualised by RBI and Govt of India to solve the overdependence problem. Otherwise RBI and GoI had no reason to introduce RuPay and they could have let the market develop organically. Recent RBI moves of data localisation and enforcement actions against Diners, American Express and Mastercard also indicate strong intent.

I'm talking about your statement of "disrupt[ing] the Indian financial system at the behest of their US govt". It's a pretty strong claim. If you have any evidence for this, please share it here.

It's a potential situation India is always worried about from a strategic aspect. India is neither strategically aligned to the US nor against it. Historically US strongly supported India's enemies and actively worked against India's interests all the way from 1945 to mid-2000's. US under various administration even threatened attack or sanctions when things don't go their way.

Current day:

Right now in 2021, US is threatening sanctions under a US law called CAATSA just because India bought a few missiles from Russia which is a long standing defence supplier to India. I know that CAATSA is forced on Biden and Trump by US Congress but it doesn't matter to India whether the US executive is doing it intentionally or not, the US state is threatening sanctions over CAATSA. In this era, when India is actively fighting/hindering Chinese agression on it's borders and taking actual casualties where acting against China is also in US interests, US threatens economic sanctions against Indian institutions and companies just because they bought a few surface to air missiles which they think are the most economical option to deter Chinese attack.

US Treasury calls India a currency manipulator and threatens to cutoff India from the USD financial system (as per US appropriation acts enacted to target China) although economists call such a designation as stupid when used against low per capita income developing countries with a current account deficit just because India tries to prevent an exchange rate blowout that could lead to many millions of Indians falling below the poverty line or losing line of income.

Historical:

In 1999, Clinton threatened to summarily sanction India on all fronts including financial when India threatened to go beyond the de-facto border to restrain Pakistan forces after they occupied Indian territory in Kargil. This threat repeated in 2002 after they supported the Pakistani position after Pakistan sponsored terrorists attacked the Indian parliament and India threatened to retaliate against Pakistan.

Every time Pakistan does something stupid against India, US intervenes and threatens to sanction India under the vacuous argument that they want to prevent a "nuclear armageddon". It's not in india's interests to succumb to such threats when they aren't the source of the problem.

In 1998, when India tested it's nukes for the 2nd time, Clinton placed a breadth of sanctions on India because US doesn't like nuclear proliferation although India had nukes sinces 1974 and everyone knew pak had since the mid-1980's and US turned a blind eye although it knew that China, Pak and North Korea are working together on them. US wants so called strategic balance between India and Pakistan and actively supports Pakistan on many issues. This prevents India from deterring China as it has spend resources countering Pakistan which itself is propped up by US Military and economic aid.

In 1971, Nixon threatened to nuke India if India doesn't withdraw from current day Bangladesh when India intervened to stop a Pakistan Army led genocide and the resulting refugee crisis. Nixon didn't follow through because India convinced USSR to provide a similar counter threat.

What happens to an economy if 100% of retail electronic transactions stop overnight?

It is not in India's sovereign interest to let foreign companies control any significant chunk of the financial sector and it's especially not acceptable if they are US companies because US frequently uses this leverage of threat of sanctions to get it's way against Indian ineterests.

Re: Indian online merchants cannot store credit card information from 2022

#147
post #55

Disclosure: I work for a fintech in India, specialized in card payment. It seems here people see this rule as "merchants can't store card numbers any more". This is actually a lot more than that, this is the new rule: you cannot store card numbers for recurring payment. Even if you are PCI-DSS compliant. Even if you are audited by the RBI. Even if you're sponsored by a bank. The only way to store a Visa number is to…

What you are saying does not align with the text of the directive. It clearly says that card numbers cannot be stored for any purpose. Quoting from the directive:

With effect from January 1, 2022, no entity in the card transaction / payment chain, other than the card issuers and / or card networks, shall store the actual card data. Any such data stored previously shall be purged.

Re: Indian online merchants cannot store credit card information from 2022

#148

Earlier quoted context omitted.

So who has to pay up. What I mean, let's say your cc data gets stolen and somebody draws money from your card, can't you just initiate a charge back?

Chargeback rights and liability of fraud for creditcards are significantly different in different regions even for seemingly identical visa/mastercard cards.

Yes, it is interesting though how it is in India, which might put low incentives on the companies to ramp up security.

Re: Indian online merchants cannot store credit card information from 2022

#149

Kudos to Indian govt, this should be the default for any e-commerce websites. I have to resort to PayPal to avoid my credit card being stored in the e-commerce merchant sites but some of sites do not support PayPal. It seems that Amazon somehow would not even allow me to delete my old and expired credit card from my account.

Be careful if you pay with PayPal in foreign currency, they have super-bad conversion rates that they try to trick you into accepting. You can turn this off if you can see through their dark patterns. But as a rule of thumb, PayPal is a scammy company that I now try to avoid where I can.

I have been burned couple of times by them. I thought it's a genuine and useful feature.

First, they offered a poor conversion rate.

Second, they said they will charge in INR and hence no further markup by banks which was an outright lie as they charged in INR from PayPal Singapore which applied foreign markup anyway by the bank. So I paid double markup.

It's basically a scam.

Re: Indian online merchants cannot store credit card information from 2022

#150

Earlier quoted context omitted.

What no? My business, and my family business both run off the ability to make upi payments by just giving a UPI Id, amount and everything your pin. Quite often, i settle accounts with my friends over UPI. One of them pays for coffee, and i just upi him his share. And we work with our own personal savings accounts.

Needs a smartphone, that’s what I was pointing out.

UPI works on USSD[1]. You need a phone but not necessarily a smartphone.

[1] https://www.npci.org.in/what-we-do/99/product-overview

Post reply on HN