India reins in contactless payments with new card rules

In a move to increase the security of card transactions, the Reserve Bank of India (RBI) is requiring all advanced features such as contactless to be turned off for new and re-issued cards until the user opts-in.

The new rules issued by the Reserve Bank of India take effect starting March 16, and require banks to bring the state of payment cards back to the 1950s where contactless, mobile, internet and cross-border transactions did not exist. Issuers are also required to disable contactless features for existing cards that have never been used online, internationally or in a contactless transaction. The change is being made under the claims of improved user convenience and increased security.

Issuers are allowed, at their own discretion based on their risk perception, to retroactively disable any and all features for existing customers that have used these card features.

The rules also require the issuers to provide a facility that would allow cardholders to turn on card not present (domestic and international), card present international and contactless transactions. Prepaid gift cards and those used at mass transit systems are exempted from the new rules.

The RBI will additionally require issuers to provide customers with the ability to switch cards on and off, set or modify transaction limits for all types of transactions for POS, ATM, online and contactless use. The card control capabilities need to be offered on a 24x7 basis through multiple channels including mobile apps, internet banking, ATMs, interactive voice response and branches.

Additionally, the RBI is requiring issuers to provide alerts through email and text message when there are any changes to the card’s status.

While it may be daunting for card issuers to comply with the new card controls requirements, the task may actually present an opportunity for the card networks such as Visa and Mastercard to promote their own card controls. It could also benefit infrastructure vendors such as Ondot Systems, which currently provides card controls to over 3,000 institutions globally. In 2018, Citi invested in Ondot Systems to improve its onboarding and customer service.