Live data from Hacker News

Indian online merchants cannot store credit card information from 2022

rbi.org.in

71–80 of 157 posts

Re: Indian online merchants cannot store credit card information from 2022

#71

Kudos to Indian govt, this should be the default for any e-commerce websites. I have to resort to PayPal to avoid my credit card being stored in the e-commerce merchant sites but some of sites do not support PayPal. It seems that Amazon somehow would not even allow me to delete my old and expired credit card from my account.

paypal is worse than credit card for me. For one the paypal always shares your paypal email address where as when I pay with credit card I always give a different email address to every merchant.

Re: Indian online merchants cannot store credit card information from 2022

#72
post #19

This is actually a good thing. Think of it like Apple's email masking service - Merchants can only store a tokenized version of your credit card instead of the real card details. I say this is a good thing after having worked with many E-Commerce shops in India as a consultant. Most of them barely know a thing about security, let alone about PCI DSS compliance. I have worked with shops that stored the entire credit c…

What is this Apple email masking service? I keep reading about it but every time I pick "Apple Pay" to pay some service it tells me it's going to give them my icloud address and it gives me no option to choose "mask my email" or anything remotely related or giving some alternate email

It's called "Hide My Email" and you can use it to sign up to services in apps:

https://support.apple.com/en-us/HT210425

Re: Indian online merchants cannot store credit card information from 2022

#73
post #30

Earlier quoted context omitted.

That's a weird generalization. Yes there are terrible, insecure e-commerce sites in India, the same as there are in the USA and everywhere else on the planet. India is also the top 7-8 e-commerce market in the world. Large local apps in the space have valuations in the tens of billions of dollars, and all major global players like Amazon and Walmart are involved in the country as well. These $100B in annual sales are…

> That's a weird generalization. Yes there are terrible, insecure e-commerce sites in India, the same as there are in the USA and everywhere else on the planet. I don't have the experience to know if this is actually the case, but it seems completely plausible that different countries have different regulations (or enforcement thereof) such that US companies have to care about PCI more than Indian companies. > These…

"such that US companies have to care about PCI more than Indian companies."

If you think about the social security number system, paper checks or credit cards with magnet strips I think you'll notice that other countries sometimes have stricter and more advanced security regulations.

Re: Indian online merchants cannot store credit card information from 2022

#74
post #19

This is actually a good thing. Think of it like Apple's email masking service - Merchants can only store a tokenized version of your credit card instead of the real card details. I say this is a good thing after having worked with many E-Commerce shops in India as a consultant. Most of them barely know a thing about security, let alone about PCI DSS compliance. I have worked with shops that stored the entire credit c…

And yet people still think hiring Indian software and IT engineers is a good idea. This is not a racist thing. So don't disagree because it hurts someone else's assumed feelings. There is a significant gap in that sort of knowledge there.

"assumed feelings"?

Does that somehow magically excuse racist statements like this? Good engineers are everywhere. Bad engineers are everywhere

Re: Indian online merchants cannot store credit card information from 2022

#75
post #55

Disclosure: I work for a fintech in India, specialized in card payment. It seems here people see this rule as "merchants can't store card numbers any more". This is actually a lot more than that, this is the new rule: you cannot store card numbers for recurring payment. Even if you are PCI-DSS compliant. Even if you are audited by the RBI. Even if you're sponsored by a bank. The only way to store a Visa number is to…

I don't agree with your interpretation on this being a stealth tactic but even if this was one it's just the state institutions acting in the interest of their mandate. This might not be beneficial to you employer or Visa or MasterCard or few high flying credit card users of the super rich class but it is in the interest of the people. If they think it's time to move beyond cards due to the strategic overdependence o…

Ah maybe my comment is not clear, I am not judging on whether this is a good/bad move for people. I wanted to explain that the card number will still be stored: it only applies to recurring payment (at least for now). So for anyone worried about entities storing the card number... this will continue.

I understand the confusion, but just to clarify I'm a big fan of UPI :).

Now, is it good move for the people? It's a complex topic, one could write a lot about it. This move will push people away from cards because card tokenization won't be supported for a while, making recurring payment harder. It's well known that very small amounts of friction can drastically reduce the conversion rate. Entering the card details every time is a hassle for sure.

So more UPI payments. But today there are no MDR for UPI transactions, meaning fintechs and banks are losing money when they process these transactions. For banks, it's supposed to be ok because a digital transaction is cheaper than a physical one. For fintechs, this is tough, you need to find money somewhere else. So less money = less incentives = less innovation. However there have been talks to put back some fees on UPI (banks are pushing a lot on this).

On the other hand, more card payments = higher MDRs. So merchants or customers, or both, will pay more to process the transactions. Banks and fintech get more money. But with a lack of competition, because of the current duopoly (Visa/Mastercard), and the difficulty to enter the market due to strict regulation, innovation is far from its peak. Just by looking at how long 3DS2 takes to roll out you can see that there is a lot inertia.

It's not black and white, as often. Personally I think UPI is a better direction. The only downside is that's it is only for domestic payment. I'd love to see an EU initiative as successful as UPI: instant payment could be the EU equivalent but the fees are crazily high in some countries.

Re: Indian online merchants cannot store credit card information from 2022

#76

I see the US Model as "Optimistic". Let the transactions through and fight back fraud with a strong chargeback mechanism. Whereas the Indian Model is "Pessimistic". Put in as much checks as possible to reduce the rate of fraud before the transaction has even completed. Thoughts?

I love it. The optimistic model forces me to be hyper aware of all my banking activities and know when fraud happens retroactively. All the Indian regulations mean I effectively don't have to worry as much unless something serious happens. CC stolen? I don't care they won't have the pin or the secure pin used for online transactions so it's useless and I can just close the card on the banking website. Mobile phone stolen? They won't have the pin to do UPI transactions so they can sell my phone but not have access to any of my banking activities. It's a total Erin. This new regulation helps prevent my card info from getting leaked by all these cheap sites with intern developers

Re: Indian online merchants cannot store credit card information from 2022

#77
post #19

This is actually a good thing. Think of it like Apple's email masking service - Merchants can only store a tokenized version of your credit card instead of the real card details. I say this is a good thing after having worked with many E-Commerce shops in India as a consultant. Most of them barely know a thing about security, let alone about PCI DSS compliance. I have worked with shops that stored the entire credit c…

This is not all that - this is a push to move people to digital wallets such as PayTM (more crony capitalism)

The fix for the problems you highlight is a audit and stringent rule of law.

Re: Indian online merchants cannot store credit card information from 2022

#78
post #19

This is actually a good thing. Think of it like Apple's email masking service - Merchants can only store a tokenized version of your credit card instead of the real card details. I say this is a good thing after having worked with many E-Commerce shops in India as a consultant. Most of them barely know a thing about security, let alone about PCI DSS compliance. I have worked with shops that stored the entire credit c…

[deleted]

Re: Indian online merchants cannot store credit card information from 2022

#79
post #23

Earlier quoted context omitted.

Do you have to use your cellphone number to avail UPI services? If that is the case, then it is not for me.

You need to have a bank account to use UPI. Banks require a phone number afaik.

Yes, I know that.

But does one need to share one's phone number to barely send or receive money?

Re: Indian online merchants cannot store credit card information from 2022

#80
post #73

Earlier quoted context omitted.

> That's a weird generalization. Yes there are terrible, insecure e-commerce sites in India, the same as there are in the USA and everywhere else on the planet. I don't have the experience to know if this is actually the case, but it seems completely plausible that different countries have different regulations (or enforcement thereof) such that US companies have to care about PCI more than Indian companies. > These…

"such that US companies have to care about PCI more than Indian companies." If you think about the social security number system, paper checks or credit cards with magnet strips I think you'll notice that other countries sometimes have stricter and more advanced security regulations.

Yes, of course. I would expect the US to be ahead of some countries in some places, and behind some countries in some places. My point is that it's perfectly plausible that in this very particular area India could be worse than the US just as, say, the EU is generally ahead of the US. And, in different areas India could be way better than the US; this isn't "good countries" and "bad countries", it's "different countries place differently on whatever metric you pick".
Post reply on HN