Skip to content
Explore Guides

Blog

RBI Card-on-File Tokenisation: What It Changed for Your Recurring Card Payments

Rahul Dabhi's profile photo Rahul Dabhi
6 min read
Reviewed by Renish Mithani Last reviewed 13 October 2026 Data verified 12 September 2026
Tokenisation RBI Rules Recurring Payments Card-on-File Autopay Fraud Prevention

What is RBI tokenisation and why does your card keep disappearing?

RBI’s card-on-file tokenisation rule says that Indian merchants and payment gateways cannot store your full 16-digit credit card number, expiry, or CVV on their servers. Instead, they store a token. A token is a randomly generated string tied to your card through your issuer and the network.

The token is what travels across the rails every time you transact. The actual card number sits only with the issuer and the network’s token vault. If a merchant’s database is breached, the attacker walks away with useless tokens, not card numbers.

For an Indian cardholder, this is why Amazon Pay, Flipkart, Zomato, Swiggy, MakeMyTrip, BookMyShow, IRCTC, and most Indian merchant apps now ask you to re-enter your credit card. You verify it with a one-time password. You grant a fresh card token. This happens once or twice a year per app. The actual card number stays private. The merchant sees a token that is single-purpose and revokable.

If your Netflix, electricity, or insurance autopay refuses to go through after a card upgrade, replacement, or token re-issue, tokenisation is almost certainly the reason. The rule was designed to make recurring card payments safer, not to silently break them.

What changed for cardholders between 2021 and 2026

RBI’s tokenisation timeline has moved in clear phases. Cardholders felt the impact most at two points. The 2022 enforcement switch was the first. The 2024-2026 token re-issuance cycle was the second. The mechanics have not changed. The cleanup work has.

Date What RBI required What cardholders noticed
March 2021 Card data storage circular; merchants must remove saved card data and use tokenisation HDFC, ICICI, and Axis apps added a “saved cards” re-verification step
July 2022 Third-party tokenisation (TPAs) framework announced LazyPay, Simpl, and other “Pay Later” apps paused debit/credit card onboarding temporarily
October 2022 Final deadline for removing stored card data; merchants move to tokenisation at scale Many users had to re-add cards to merchant apps; e-mandate rules also tightened
April 2024 Token lifecycle standards updated; issuer-managed tokens now default Cards added to Apple Pay, Google Pay, Samsung Pay became stable across updates
2024-2026 Token re-issuance waves as issuers rotate vaults and devices Subscribers see one-time re-OTP prompts on Amazon Pay, Flipkart, Zomato, Swiggy, IRCTC

The headline rule has not changed since the 2021 circular. What changed is the operational plumbing: more merchants, more acquirers, and more issuers conformed each year, and the wave of token re-issues kept coming. If you have been asked to re-add your credit card to Swiggy twice in 2026, that is the issuer rotating its token vault, not a different rule.

Tokenisation versus auto-debit and e-mandate: three different things

The biggest confusion is the difference between tokenisation, auto-debit, and an e-mandate. All three can hit your card without you swiping. But they have different rules.

Tokenisation is about how the merchant stores your card. The token replaces your card number. If the merchant is hacked, nothing useful leaks. Tokenisation does not by itself authorise any future charge. The merchant still sends each transaction through the network for issuer approval.

Auto-debit is when you set a recurring payment with a fixed frequency and amount. The merchant sends a transaction on the agreed date. Your issuer approves or declines. Auto-debit does not need tokenisation. It can run on a stored card number. But RBI’s 2021 rule says merchants cannot store the raw card number. So most auto-debits now run on tokens.

E-mandate is the formal framework for recurring payments. It caps recurring amounts. It mandates an OTP before the first charge. It gives you a 24-hour pre-debit notice. It forces re-authentication every 5 years. E-mandate applies to both cards and UPI AutoPay. It governs subscriptions like Netflix, Spotify, and insurance premia.

Three concrete examples:

  • Zomato Gold monthly autopay — runs on a token; the merchant’s stored data is a token, not your card number. The transaction itself is auto-debit. It may or may not be inside an e-mandate envelope, depending on whether Zomato and your issuer have registered the instruction with the Recurring Payment registry.
  • Electricity bill autopay — typically e-mandate (₹5,000 ceiling applies for debit cards; credit cards are treated separately); the biller pulls from your card through a token if your card is stored on their portal.
  • IRCTC e-wallet top-up via credit card — tokenised card storage, not a recurring mandate; the top-up happens once per recharge, and the IRCTC app holds the token for re-use.

If your autopay fails after a token re-issuance, the merchant app will usually let you re-add the card. If the failure persists, the fix is at the issuer — call the bank’s 24-hour helpline (HDFC: 1860-267-6161, ICICI: 1860-120-7777, Axis: 1860-419-5555, SBI: 1860-180-1290) and ask them to refresh the token vault for that merchant.

What tokenisation does NOT change

Tokenisation is a storage rule, not a transaction rule. It does not affect your credit limit. It does not affect your interest rate. It does not affect your grace period. It does not affect your statement cycle. It does not affect your reward points. It does not affect fraud liability. Fraud liability is governed by RBI’s customer-protection framework. The framework puts the burden on the issuer for unauthorised transactions. It gives the issuer three days to acknowledge a dispute. It gives the issuer ninety days to resolve it.

Tokenisation also does not change foreign-currency markup. It does not change GST on credit-card fees. It does not change the issuer’s right to decline a transaction. Tokenisation is invisible at the swipe or tap point. The only visible change for cardholders is the one-time re-verification prompt during card storage. It also means the occasional token refresh.

What you should do when a tokenised autopay breaks

If your Netflix, insurance premium, or utility autopay stops working after a token refresh or a card upgrade:

  1. Open the merchant app and re-add the card. The merchant will prompt you to verify with a one-time password (the OTP goes to your registered mobile number). The card number itself is unchanged — you re-tokenise it.

  2. Use the bank’s app to monitor tokenised merchants. HDFC, ICICI, Axis, and SBI expose a “Saved Cards” or “Tokenised Cards” list where you can see which merchant holds a token against your card, and revoke a token without replacing the card. Revoking a token does not close your card.

  3. Check your e-mandate registration. For recurring amounts above ₹5,000 (for debit cards) and certain recurring payments (for credit cards), the instruction must be registered under RBI’s e-mandate framework. If your autopay is unregistered, the merchant cannot legally retry on the due date.

  4. If the merchant cannot fix it, hotlist only that token — not the card. Almost every bank app has a “manage tokens” screen. Revoking the merchant’s token blocks that merchant, and only that merchant, from charging your card again. Your card continues to work everywhere else.

  5. If dispute is unavoidable, file within three days. Use the bank’s dispute form, attach the failed-payment screenshot, and quote the merchant’s transaction reference. Most banks auto-refund tokenised-card disputes that happened due to merchant-side bugs; the merchant-bearer is responsible for issuing-side errors under the network rules.

Rupee impact in a typical Netflix case. A Re 199/month Netflix plan, if autopay fails for two months while you re-tokenise, costs you around ₹398 in missed service (which Netflix usually credits back) and zero in late fees — Netflix does not charge a late fee on autopay failure. Where the rupee math gets expensive is a utility autopay that triggers a late-payment surcharge from the biller: a 2% interest-and-late-fee layer added to a ₹4,000 electricity bill is ₹80 per missed cycle, which is why the fastest fix matters.

What changed for international merchants and travel

Tokenisation is a domestic rule. International merchants — Apple iCloud, Spotify (when paid in USD), Google Play, Airbnb, Uber — fall outside RBI’s jurisdiction. They can and do store your raw card number on file. If your international autopay fails after a card upgrade, the fix is to log in to that merchant and update the card details manually; the merchant is not tokenised against your Indian issuer.

This is also why cards used for international travel often have higher foreign-transaction fees baked into their value: the merchant-tokenised flow that protects your card data exists only for Indian merchants, and international merchants continue to store card numbers normally. Zero-forex cards (RuPay-exclusive cards, plus a few Visa/Mastercard options) keep the in-India tokenisation benefit while reducing the cost of the international transaction.

Our take

RBI’s tokenisation rule is the single biggest Indian-cardholder-facing consumer-protection change in the past five years. Done well, it makes card-on-file recurring payments safer because a leaked merchant database leaks tokens, not card numbers. Done clumsily, it leaves cardholders confused when their autopay refuses to go through after a token refresh.

The two operational signals worth remembering are: tokenisation protects stored card data, not the transaction itself; and e-mandate protects the recurring payment, with a 24-hour pre-debit alert and a strict re-authentication cycle. If a merchant autopay keeps failing despite a working card and a working bank app, the fix is to revoke the old token and re-issue a new one — a 60-second task that costs nothing, requires no card replacement, and does not affect rewards or credit-limit utilisation. Most banks expose this through a “Saved Cards” or “Manage Tokens” screen; if yours does not, the bank’s card-services helpline can refresh tokens for any specific merchant without affecting the rest of your card.

Sources

Share: X (Twitter) LinkedIn WhatsApp

← All blog posts