Card security? RBI has done half the job.

December 29, 2023
Devinder Dhingra

Satyam (The Truth)

Towards the end of the last year, RBI came up with a card storage guidelines and asked e-commerce and other online sellers of products and services to remove the credit card and debit card details from their database and left it on the customers to make a decision whether they wanted their card details permanently available with the respective vendor.

A good step indeed, given that there lies a safety threat, an impulsive or wrong buying in case the card details are left permanently at a website.

But actually, it is half-done.

Still, we have many sellers like OTT platforms, subscription-based service providers and such others who force us to choose Auto-pay option.

What’s an Auto-pay?

Aren’t they taking our card details and keeping it permanently with them without seeking our consents in Auto-pay?

Isn’t it a lack of confidence that they think if such an option is not there, they would lose the customers?

Is it not a similar security threat?

In fact, sometimes we don’t opt for such services that force us to choose auto-pay unless it becomes really our need. And that way, these service providers must realize that they are losing a few clients as well by keeping such a payment option only.

Why should RBI allow them to do this?

When the RBI planned a good step, they shouldn’t have left some holes and should have considered everything available in the market. Isn’t it?

Shivam (The Solution)

RBI must intervene and in consultation with the respective ministry that regulates the service providers do and get done the following to make their card storage guidelines more robust:

1. Restrict the Auto-pay payment-based service providers and make it mandatory for them to offer the Auto-pay as an alternative mode of payment. This means Auto-pay should be a choice and not the only payment option available with any vendor.
2. Once a customer gives consent for storing their card details, service providers and sellers must be asked to periodically (maybe on a six-months basis) seek the consent of their clients again for storing their cards’ information.

Author’s Note (updated March 2024): After follow-up with the RBI on this, I received a reply from them that the restriction of Rs. 2000 in a single transaction and making it mandatory to allow customers to cancel the Auto-Pay are the measures RBI had initiated in this regard.

The action by the RBI is commendable and it is understandable that they are not the authority to regulate the merchants. However, from the customer’s perspective the matter is still viewed the same way unless the issue is resolved.

More to read

 

Fourth Floor on HSVP Plots - A Backdoor entry

 

OPS versus NPS - What Goverment should do?

 

 

Nothing is Stable

 

Do planets affect us scientifically?