Card tokenisation

Card tokenisation replaces your real card number with a unique token for each app or website, so a leak does not expose your actual card.

Card tokenisation: Card tokenisation swaps your actual card number for a random substitute called a token, which works only with one merchant and device. When you pay, the shop sees the token, not your real number. RBI rules require merchants not to store raw card details.

In practice, you will see a prompt asking whether you want to save the card as per the RBI guidelines. You agree, confirm with an OTP, and next time you may only need the last four digits and the CVV. The shop never holds the full number, so a data breach at that shop does not leak your card. The same card can have different tokens on different apps and phones.

It does not remove the need for care. A fake checkout page can still trick you into typing the card details, and the token is only as safe as your phone. Tokens can be viewed and deleted in your bank or card app, so remove any shop that you no longer use. A little tidying of old tokens reduces the places where your card could be misused.

Tips

• Review the list of saved tokens in your bank app and delete shops you do not use.
• Save a card only on sites and apps you know and trust.
• Never type card details on a page reached from an SMS link.

Related terms