CARD ON FILE TOKENIZATION (CoFT)

• Tokenization is the process of replacing sensitive data, such as credit/debit/prepaid card numbers, with unique identification data while retaining all the essential information about the data. It is a replacement of actual or clear card number with an alternate code called the “Token”. This shall be unique for a combination of card, token requestor (i.e., the entity which accepts request from the customer for Tokenization of a card and passes it on to the card network to issue a corresponding token) and the merchant (token requestor and merchant may or may not be the same entity).

• Card-on-File (CoF) tokenization provides two key benefits – consumer & ecosystem security and an enhanced checkout experience. A Tokenized card transaction is considered safer as the actual card details are not shared / stored with the merchants to perform the transaction.

• Card provisioning is done wherein consumer enrolls their account with a digital payment service provider (such as an online retailer or mobile wallet) by providing their primary account number (PAN), security code, and other account information.
• Card gets added at site/app with successful consumer verification i.e., OTP and in the backend token credentials gets generated.
• After Tokenization Process is completed, tokenized card details will be used in place of the actual card number for future online purchases initiated or instructed by the card holder.

• The card holder can get the card Tokenized by initiating a request on the website/app provided by the merchant.
• The token requestor / merchant will forward the request directly to the issuing Bank which issued the applicable Debit Card - RuPay/Visa/Mastercard with the consent of the card issuing Bank.
• The entity receiving the request from Token requester, will issue a token corresponding to the combination of the card, the token requestor, and the merchant.

• As on 1st July 2022, all CSB Debit Cards have to be Tokenized

• No. Tokenization is only applicable only for Domestic transactions.

• Customer can reach out to bank’s Customer Care Team at 1800 266 9090, +91 22 69578500, +91 22 45393950 for their tokenized cards.

• No. Tokenization is only required for carrying out the online transactions

• The facility is free of charge and customer need not pay anything for availing the service of Tokenizing the card.

• Tokenization and De-Tokenization can be performed only by the card issuing Bank or Visa / Mastercard / RuPay / Diners who are referred as authorized card networks.

• Actual Card data, token and other relevant details are stored in a secure encrypted mode by the card issuing Bank and / or authorized card networks. Token requestor / merchants cannot store full card number or any other card detail.

• The registration for a Tokenization request is done only with explicit customer consent through Additional Factor of Authentication (AFA), and not by way of a forced / default / automatic selection of check box, radio button, etc. Customer will also be given choice of selecting the use case and setting-up of limits.

• A customer can request for Tokenization of any number of cards to perform a transaction.

• For performing any transaction, the customer shall be free to use any of the cards registered with the token requestor / merchant.

• Customer will see the last 4 digits of the card on the merchant page

• Customer needs to re-visit the merchant page and create a fresh token.
• Alternatively, they may also reach out to bank’s Customer Care Team for related support.

• Yes. A token must be unique to the card at a specific merchant. If the customer intends to have a card on file at different merchants, then tokens must be created at all the merchants.

This process ensures you have full control over card transactions. You can Deactive, suspend and resume tokens accordingly allowing you to get full control over your cards to be used on different merchant apps/websites.

Token Controls You Can Use

1. Deactivate Token

Use this when you no longer want your card stored on the merchant

• Permanently removes the token
• Payments done from that merchant page/app will stop
• To use the card again, you must set up the token (page/app) again

2. Suspend Token

A temporary pause on your token.

• Useful if you misplace your phone/device
• Blocks payments instantly
• Can be reversed anytime

3. Resume Token

Turns your suspended token back on.

• Restores your ability to make payments
• No setup or re-tokenization needed

• Based on risk perception, etc., card issuers may decide whether to allow cards issued by them to be registered by a token requestor.

• Normally, in a tokenized card transaction, parties / stakeholders involved are merchant, the merchant’s acquirer, card payment network, token requestor, issuer, and customer. However, an entity, other than those indicated, may also participate in the transaction.

• No, a customer can choose whether or not to let his / her card Tokenized. If not Tokenized, starting 1st July 2022, the card holder must enter the full card number, CVV and Expiry date every time to complete their online transactions.