Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Indian online merchants cannot store credit card information from 2022

rbi.org.in

Post reply on HN
Print view View original

41–50 of 157 posts

Re: Indian online merchants cannot store credit card information from 2022

#41

Post by NavinF »

neya wrote: post #19

This is actually a good thing. Think of it like Apple's email masking service - Merchants can only store a tokenized version of your credit card instead of the real card details. I say this is a good thing after having worked with many E-Commerce shops in India as a consultant. Most of them barely know a thing about security, let alone about PCI DSS compliance. I have worked with shops that stored the entire credit c…

I agree as long as merchant banks let you transfer tokenized cards to a new provider. Otherwise businesses will get locked into one provider for recurring billing.

(No, this doesn’t make tokenized cards as dangerous as card numbers. Transferring a merchant account is a whole process. Not to mention that when a breach happens, you can cancel one merchant’s tokens without forcing every customer to get new cards)

Re: Indian online merchants cannot store credit card information from 2022

#42

Post by diebeforei485 »

Something I learned in college - not all countries have the same laws as the US where it's easy to dispute a charge and the burden of proof is with the merchant.

If India is one of those places where the burden of proof is on the customer, and it's difficult to dispute charges, it makes sense to tokenize things.

Re: Indian online merchants cannot store credit card information from 2022

#43

Post by ghoomketu »

blueblisters wrote: post #15

Is the RBI deliberately trying to handicap credit cards in India? The decision to make recurring payments impossible, followed by having to enter card information every time I do an online transaction is making for a very frustrating experience. The justification for these decisions is always "consumer interest" but how is making consumers jump through hoops to do transact online in consumer interest? I wish the indu…

Yes this is stupid and it has caused me a lot of trouble since this all started. I am now seriously thinking of leaving this country and going to NZ or Canada (something which I did not want to do because of my parents).

Doing business in India is so frickin hard, especially after GST. I have to spend so much time on accounting nowadays and it's getting harder and harder every day (even though all the ads say otherwise).

I almost got my Digitalocean account suspended few months back because the credit cards won't bill anymore. Now i have to constantly monitor GCP, Porkbun, AWS, etc since nobody can bill me like before.

Also for some reason Indians aren't allowed to keep balance in Paypal but a lot of my customers prefer to pay via it, which means in the end I cannot process any refunds on time and makes customers angry (Paypal wants me to snail mail checks to them to add the USD balance since govt has banned adding the same from Bank account).

For recurring charges now you have to create an account with https://www.sihub.in which doesn't accept small businesses kinda making it an exclusive club for big companies. It's really a shit-show here.

If it were not for Stripe Atlas I would have been out of business a long time ago. So thank god for that.

Re: Indian online merchants cannot store credit card information from 2022

#44

Post by deathtrader666 »

paxys wrote: post #30
neya wrote: post #19

This is actually a good thing. Think of it like Apple's email masking service - Merchants can only store a tokenized version of your credit card instead of the real card details. I say this is a good thing after having worked with many E-Commerce shops in India as a consultant. Most of them barely know a thing about security, let alone about PCI DSS compliance. I have worked with shops that stored the entire credit c…

That's a weird generalization. Yes there are terrible, insecure e-commerce sites in India, the same as there are in the USA and everywhere else on the planet. India is also the top 7-8 e-commerce market in the world. Large local apps in the space have valuations in the tens of billions of dollars, and all major global players like Amazon and Walmart are involved in the country as well. These $100B in annual sales are…

Yes, but large valuations don't correlate with better security practices.. Obviously the person above isn't talking about Amazon or Walmart when referring to "script kiddies".

Of the nearly 45-50 contract jobs I've seen, a lot of them use pirated WP or Magento plugins, and plain text storage of sensitive content.

Re: Indian online merchants cannot store credit card information from 2022

#45

Post by nicolinox »

I found the approach of disposable virtual card numbers (Visa and Mastercard) that Revolut is giving to each app owner for free is amazing. This number (always different) can be autopopulated from a browser plugin during checkout from the PC and has a very smooth user experience. I don't need to take a card out of my wallet or open the smartphone app to do this. I am happy and regulator is happy too, in this case.

Re: Indian online merchants cannot store credit card information from 2022

#46

Post by vishnugupta »

sudhirj wrote: post #20
blueblisters wrote: post #15

Is the RBI deliberately trying to handicap credit cards in India? The decision to make recurring payments impossible, followed by having to enter card information every time I do an online transaction is making for a very frustrating experience. The justification for these decisions is always "consumer interest" but how is making consumers jump through hoops to do transact online in consumer interest? I wish the indu…

So the order doesn’t prohibit tokenizing or saving cards, it specifies who can save them. Earlier, merchants could save the details, and this ability leads to massive amounts of fraud and theft (see US right now). Then only regulated payment aggregators could save them, and issue a token to the merchants. Stealing the token wasn’t too helpful because you couldn’t grab the money, the token was tied to the merchant. Bu…

Thanks for clear and jargon-free response. I wish this were top-level and top comment.

Re: Indian online merchants cannot store credit card information from 2022

#47

Post by Abishek_Muthian »

neya wrote: post #19

This is actually a good thing. Think of it like Apple's email masking service - Merchants can only store a tokenized version of your credit card instead of the real card details. I say this is a good thing after having worked with many E-Commerce shops in India as a consultant. Most of them barely know a thing about security, let alone about PCI DSS compliance. I have worked with shops that stored the entire credit c…

RBI(Central bank) has been filling-up for a long time for the total lack of security practices by merchants & data-privacy laws.

e.g. One can control how much money can be withdrawn from the credit/debit card per-day according to domestic/International merchants/online/physical/ATM/ etc. through net-banking with the minimum in the multiples of INR 1000. So even if the card data gets stolen, Criminals can utmost withdraw only the minimum amount in the other part of the world.

But unfortunately due to the digital-divide, Not many have access or awareness of such facilities and hence control over card data is required.

IMO the single point of failure for India's financial security is its extraordinary dependence on mobile number for 2FA, Even security conscious customers can do little against SIM jacking attacks, But for those who are not security conscious; all it requires is a social engineered SMS with ngrok URL[1] or Phone call asking for that OTP.

Please write to RBI and demand your bank to support hardware tokens (or) at least TOTP.

> 3. PayTm (One of the largest, if not the largest digital payments app in India)

Did you mean that largest digital payments company which integrated the PoS facility on the merchant's app and the customers were asked to enter their credit/debit card details manually?[2]

[1] https://twitter.com/Abishek_Muthian/status/14069649600815718...

[2] https://abishekmuthian.com/paytm-says-to-me-that-its-pos-fea...

Re: Indian online merchants cannot store credit card information from 2022

#48

Post by supernova87a »

I'm interested to know what level of "cannot store" the info is implemented? Or is it mediated by a 3rd party company / algorithm that sanitizes the data but to a certain amount that some association can still be done?

For example, can the customer's credit card be anonymized but still tracked to know that the same credit card is used on 2 different transactions, for example?

E.g. if I wanted to give the customer only 1 special offer per credit card number, is that possible for the retailer to tell? Or is it even more sanitized such that every single transaction gets a different hashing?

How do refunds get issued if the number can't be stored and presumably you don't want the retailer to have the backwards decoding to be possible?

Re: Indian online merchants cannot store credit card information from 2022

#49

Post by spikengineer »

rg111 wrote: post #23
vivekv wrote: post #3

Earlier quoted context omitted.

Indian merchants have to support UPI - another payment mechanism which is secure. I tend to use that in most places so that I dont have to store my card details.

Do you have to use your cellphone number to avail UPI services? If that is the case, then it is not for me.

UPI primarily uses a virtual private address in the form of an email address.

You only need to disclose this vpa to the merchant.

It looks like username@statebank

You don't need to disclose your phone number or bank account number to the merchant if you don't want to as UPI has multiple address mechanisms.

You can also use QR

Re: Indian online merchants cannot store credit card information from 2022

#50

Post by konschubert »

teleforce wrote: post #2

Kudos to Indian govt, this should be the default for any e-commerce websites. I have to resort to PayPal to avoid my credit card being stored in the e-commerce merchant sites but some of sites do not support PayPal. It seems that Amazon somehow would not even allow me to delete my old and expired credit card from my account.

Be careful if you pay with PayPal in foreign currency, they have super-bad conversion rates that they try to trick you into accepting. You can turn this off if you can see through their dark patterns.

But as a rule of thumb, PayPal is a scammy company that I now try to avoid where I can.

Post reply on HN