Jargon busted

Tokenisation (CoFT)

Short answer

Tokenisation replaces your real card number with a random stand-in — a token — that works only at the merchant it was created for. Under RBI rules, online merchants can no longer store your actual card number at all; when you save a card on a shopping site, what is stored is a token. If that merchant is breached, the leaked token is useless anywhere else.

What it means

Before 2022, shopping sites kept actual card numbers on file, and every merchant breach leaked real cards. RBI's card-on-file tokenisation rules ended that: merchants must purge stored card numbers, and saved cards work through tokens issued by the card network with your consent.

What a token is: You save your card on a food-delivery app. The network generates a random number tied to that app alone. The app never sees your real number. A thief who steals the token can order nothing anywhere else with it.

The common mistake

Assuming a saved card is a stored card. The "saved card" you see on a merchant today is a token plus the last four digits for display. That is also why, after your card is renewed or reissued, some saved cards keep working — the token maps to the account, not the plastic.

The subtlety worth knowing

Tokens are per-merchant, so deleting your card from one site kills only that token. For a full reset — after a phone theft, say — your bank's app lists every token issued against your card and lets you delete them centrally.

CVV · Virtual card · Transaction controls

All figures on this page are indicative and dated. Rates and fees differ by bank and change over time. Always verify with your bank's official schedule of charges.

Frequently asked questions

Is it safe to save my card on shopping sites now?

Far safer than it used to be. The site stores a token that only works there, not your card number. You still confirm each save with OTP consent, and you can delete tokens from your bank's app or the merchant's saved-cards page.

Do I have to tokenise my card?

Only if you want one-click payments. You can always decline saving the card and type the full number each time — nothing is stored in that case. Tokenisation is the rule for how cards may be saved, not an obligation to save them.

Sources

The regulation and official pages this page is checked against. If one of them disagrees with us, it wins.

Tokenisation — Card Transactions: Card-on-File Tokenisation (CoFT) Services — Reserve Bank of India

Written and checked by the CardSamajh editorial desk · Last reviewed: 24 August 2026 · How we check this