Non-face-to-face transactions in which the cardholder authorizes the merchant, either at the time of the transaction or previously, to store the card data (card number and card expiration date), and in which the merchant carries out the transaction using this stored card data, are called transactions performed with stored card data (Credentials-on-File). In our country, these transactions are distinguished in the clearing file in TCR0 field 62-163, and in the switch (online) in DE22 field, first sub-field, with the value ”10”.
As the importance of digital channels continues to grow, Credential-on-File (CoF) payments, spanning everything from mobile devices to the Internet of Things, will play an increasingly important role in the future of digital commerce. E-commerce grew from 398 billion dollars in 2016 to 692 billion dollars in 2020, and mobile commerce (m-commerce) showed an even more striking increase, from 116 billion dollars in 2016 to 336 billion dollars in 2020. Meanwhile, according to a 2016 Deloitte study (“Default” Payment Methods, 2016), the increasing availability of CoF has been shown not only to create opportunities in the payment ecosystem but also to reshape consumer behavior.
The details under Article 18 of the Draft Communique on the Management of Information Systems Used in Bank and Credit Card Transactions
are given below:
ARTICLE 18 – (1) On behalf of the merchant, at the cardholder's request and in accordance with the provisions of this Communique, card data may be stored only with the institution holding the merchant agreement or with that institution's external service provider. The merchant obtains the cardholder's request in a demonstrable, written or electronic form, and ensures non-repudiation.
(2) The institution storing the card data generates, for storage by the merchant on whose behalf the card data is stored, a reference code that represents the card number, the cardholder, and the merchant, has a limited lifespan, cannot be processed in any way to reveal the sensitive card data, and cannot be used to carry out a fraudulent transaction in the cardholder's name if obtained by unauthorized parties. If the reference code is specific to the merchant on whose behalf the card data is stored and is transmitted to the institution storing the card data only by that merchant, the card data can then be used. The institution storing the card data verifies the merchant's identity and establishes access controls both before the reference code is generated and during the use of the reference code and card data.
(3) In cases where card data is stored on behalf of the merchant, the stored sensitive card data is never transmitted to the merchant under any circumstances. Stored card data is not shared with parties other than those explicitly authorized by law.
(4) Sensitive card data stored on behalf of the merchant is deleted on the first day of the month following the date on which it has gone unused for payment purposes for two years.
The relevant Communique can be accessed at the following link:
https://www.bddk.org.tr/ContentBddk/dokuman/mevzuat_0821.pdf
