News for hackers. Stuff that matters.

A comment on Indian online merchants cannot store credit card information from 2022. Parent comment

Re:Indian online merchants cannot store credit card informat... by AmericanChopper on Friday December 17, 2021 @04:38AM (#29589937)
That number needs to be mapped to the PAN, and somebody has to have stored that PAN somewhere in order for it to be used to process payment. This rule says nobody other than the issuer and the card brands are allowed to store the PAN.
[ Parent | on HN ]
Re:Indian online merchants cannot store credit card informat... by Dylan16807 on Friday December 17, 2021 @05:29AM (#29590316)
Sure, that's why you get the token from the issuer or card brand. That way there's only one entity that stores the PAN, and no third parties are storing it.

To quote the article linked above, "The central bank said the facility of tokenisation shall be offered by TSPs only for the cards issued by/affiliated to them."

[ Parent | on HN ]