Card-not-present transactions that a merchant performs using stored card data (card number and card expiry date), to which the cardholder gave the merchant consent either at the time of the transaction or earlier, are called Credentials-On-File transactions.
The first transaction a customer makes after their card details are stored is referred to as the "First Credential-On-File transaction". It can be considered riskier than stored card data that has already been used for many transactions.
For this reason, BKM (Interbank Card Center) expects these transactions to be distinguished by sending the value "C" in field DE48.PDS86 of the switch message.
The details are set out below in Article 18 of the Draft Communique on the Management of Information Systems Used in Bank and Credit Card Transactions:
ARTICLE 18 - (1) At the request of the cardholder, card data may be stored on behalf of the merchant, in accordance with the provisions of this Communique, only with the institution that enters into the merchant agreement or with an outsourced service provider of that institution. The merchant receives the cardholder's request in a provable manner, in writing or electronically, and ensures non-repudiation.
(2) The institution storing the card data generates, for the merchant on whose behalf the card data is stored to retain, a reference code that represents the card number, the cardholder and the merchant, has a limited lifetime, does not allow access to sensitive card data through any processing, and cannot be used to make fraudulent transactions on behalf of the cardholder if captured. The card data can be used only if the reference code is specific to the merchant on whose behalf the card data is stored and is submitted to the institution storing the card data only by that merchant. The institution storing the card data verifies the identity of the merchant and establishes access controls both before generating the reference code and while the card data is used with the reference code.
(3) Where card data is stored on behalf of the merchant, the stored sensitive card data is not transmitted to the merchant in any form. Stored card data is not shared with parties other than the authorities expressly authorized by law.
(4) If the sensitive card data stored on behalf of the merchant is not used for payment purposes for two years, it is deleted on the first day of the month following the expiry of the two-year period.
The relevant Communique is available at the link below:
https://www.bddk.org.tr/ContentBddk/dokuman/mevzuat_0821.pdf
