Bank fraud value in India tripled to Rs 36,014 crore in FY25, and card and internet fraud is now the largest category by number of cases. If you sell online in India, your checkout is the primary target.<\/p>\n
You may assume your gateway provider handles all of this. They handle most of it. But specific obligations now sit with you, the merchant, and getting them wrong creates compliance gaps and lost sales.<\/p>\n
Payment gateway security is a stack of controls. Some the gateway owns, some you own. This guide maps which is which, what “secure” means in measurable terms, and what to verify before you go live.<\/p>\n
A secure payment gateway is a payment processing system that protects customer financial data at every stage of a transaction – capture, transmission, authorisation, and storage – using encryption, tokenization, and authenticated access controls, while meeting PCI DSS standards and, in India, the RBI’s Digital Payment Security Controls Directions, KYC (Know Your Customer) norms, and AML (Anti-Money Laundering) obligations under the Prevention of Money Laundering Act (PMLA).<\/p>\n
One in five Indian families with a UPI user experienced payment fraud at least once in the last three years, and over 51% never reported it, per a LocalCircles survey via Business Standard.<\/p>\n<\/div>\n
A secure payment gateway protects transactions using five interlocking layers: encryption in transit (TLS), encryption at rest (AES-256), tokenization, multi-factor authentication for access, and real-time fraud detection. No single layer is sufficient alone. Together they create a defence-in-depth architecture.<\/p>\n
Pro tip:<\/strong> During onboarding, ask: “What algorithm do you use for data at rest, and how are keys managed?” If they cannot answer with “AES-256” and “HSM-stored keys with scheduled rotation,” escalate before signing.<\/p><\/blockquote>\n
Layer 2 – Tokenization and the RBI Card Storage Mandate<\/h3>\n
Tokenization replaces a customer’s actual card number with a unique, random token that has no mathematical link to the original. Even if intercepted, the token is useless to an attacker. The real card number is stored securely by the card network, not by the merchant or gateway.<\/p>\n
What RBI’s Tokenization Mandate Means for You<\/h4>\n
\n
- Since October 2022, RBI has mandated that merchants cannot store raw card data. All card-on-file data must be replaced with tokens issued by the card network.<\/li>\n
- This applies to every Indian merchant offering saved cards or recurring billing. Tokenisation services are free and available only through authorised card networks, per HDFC Bank.<\/li>\n
- The customer experience is identical. The architecture is stronger because raw card numbers never leave the network’s vault.<\/li>\n<\/ul>\n
Gateway Tokenization vs Network Tokenization<\/h4>\n
\n
- Gateway tokenization: the gateway substitutes its own internal token but still holds the mapping to the real card number.<\/li>\n
- Network tokenization: the card network issues the token and the card number never leaves the network. This is what RBI’s mandate requires.<\/li>\n
- RBI has also enabled card-on-file tokenisation directly at the issuer bank level, per Deccan Chronicle. Confirm your gateway supports network tokenization for card-on-file use cases.<\/li>\n<\/ul>\n
Layer 3 – 3D Secure Authentication for Card-Not-Present Transactions<\/h3>\n
3D Secure (3DS) is an authentication protocol that adds a verification step between a card payment and final authorisation. In 3DS 2.0, the issuing bank uses device data and risk signals to silently approve low-risk transactions or prompt for OTP verification.<\/p>\n
\n
- In India, RBI mandates additional factor authentication for card-not-present transactions. 3DS 2.0 is the primary mechanism.<\/li>\n
- You do not implement 3DS yourself. Your gateway routes the request to the card network. Confirm your gateway supports 3DS 2.0, not just the older 3DS 1.0.<\/li>\n
- 3DS 2.0 shares more data points with the issuing bank, enabling risk scoring without always requiring an OTP – reducing cart abandonment while maintaining security.<\/li>\n<\/ul>\n
Layer 4 – Key Management and Hardware Security Modules (HSMs)<\/h3>\n
Key management is the practice of generating, storing, rotating, and revoking the cryptographic keys that make encryption work. A Hardware Security Module (HSM) is a tamper-resistant device certified to store and use these keys securely.<\/p>\n
\n
- The common mistake: storing encrypted data and its encryption key in the same environment. If compromised, both are exposed.<\/li>\n
- Correct practice: keys stored separately in an HSM certified to FIPS 140-2 Level 3 or higher, with a documented rotation schedule.<\/li>\n
- Split knowledge and dual control: for the most sensitive key operations, no single person holds the full key.<\/li>\n<\/ul>\n
Layer 5 – Real-Time Fraud Detection<\/h3>\n
\n
- Modern gateways score each payment in real time using machine learning, before authorisation.<\/li>\n
- Signals monitored: transaction velocity, geo-location anomalies, device fingerprinting, and behavioural deviation.<\/li>\n
- India-specific: velocity checks catch rapid sequential low-value UPI transactions used to test stolen credentials.<\/li>\n<\/ul>\n
Layer 6 – KYC, AML, and Merchant Due Diligence<\/h3>\n
KYC (Know Your Customer) and AML (Anti-Money Laundering) controls are mandatory for every payment aggregator operating under RBI’s Payment Aggregator Guidelines. These controls verify who is transacting and flag suspicious activity before it enters the banking system.<\/p>\n
What KYC means for payment gateways in India<\/strong><\/h4>\n
Every RBI-authorised Payment Aggregator must perform merchant KYC at onboarding. This includes verifying business identity through PAN, GST registration, and Certificate of Incorporation, confirming Ultimate Beneficial Ownership (UBO) of the merchant entity, conducting background checks against RBI and SEBI defaulter lists, and applying Enhanced Due Diligence (EDD) for high-risk merchant categories such as gaming, crypto, or forex.<\/p>\n
What AML means for payment gateways in India<\/strong><\/h4>\n
Under the Prevention of Money Laundering Act (PMLA), 2002, payment aggregators must implement transaction monitoring systems that flag unusual velocity, value, or geographic patterns, file Suspicious Transaction Reports (STRs) with the Financial Intelligence Unit – India (FIU-IND), maintain records of all transactions for a minimum of five years, and conduct periodic merchant re-KYC to ensure ongoing compliance.<\/p>\n
What to verify in a gateway’s KYC and AML controls<\/strong><\/h4>\n
Ask whether the gateway performs automated merchant KYC with document verification at onboarding. Confirm that the gateway has a dedicated compliance officer and files STRs with FIU-IND. Check if the gateway conducts periodic re-KYC and ongoing risk scoring of active merchants. Verify that the gateway’s merchant onboarding process includes UBO identification, not just business name verification.<\/p>\n
Pro tip: RBI updated its KYC Master Directions in 2025 and introduced new requirements for Payment Aggregators, including agent-assisted KYC. Ask your gateway whether their onboarding process reflects the latest RBI KYC framework, not just the 2022 version.<\/p>\n
Pro tip:<\/strong> Configure fraud thresholds actively. Review your false-positive and chargeback rates monthly and adjust.<\/p><\/blockquote>\n
How Razorpay Builds Security Into Every Layer<\/h2>\n
Razorpay is India’s first full-stack financial solutions company and received RBI’s final authorised Payment Aggregator (PA) license in December 2023<\/a>. Here is how our security architecture maps to this guide:<\/p>\n
\n\n
\n \nSecurity Layer<\/th>\n What Razorpay Does<\/th>\n<\/tr>\n<\/thead>\n \n Encryption<\/td>\n PCI DSS Level 1 certified infrastructure with TLS and AES-256<\/td>\n<\/tr>\n \n Tokenization<\/td>\n Network tokenization for saved cards, compliant with RBI’s October 2022 mandate<\/td>\n<\/tr>\n \n 3D Secure<\/td>\n Full 3DS 2.0 support for card-not-present authentication<\/td>\n<\/tr>\n \n Fraud Detection<\/td>\n Thirdwatch, AI-powered fraud prevention covering payment fraud and pre-shipment RTO risk<\/td>\n<\/tr>\n \n UPI Security<\/td>\n Dynamic QR codes per transaction, UPI Autopay with RBI-compliant mandate flows, Turbo UPI<\/td>\n<\/tr>\n \n System Uptime<\/td>\n 99.99% uptime over the last 12 months<\/td>\n<\/tr>\n \n Smart Routing<\/td>\n Optimiser routes across multiple aggregators, improving success rates to 90-95%<\/td>\n<\/tr>\n \n API Security<\/td>\n Signed webhooks, idempotency keys, and replay protection<\/td>\n<\/tr>\n \n KYC and AML Compliance<\/td>\n Automated merchant KYC with PAN, GST, and UBO verification at onboarding. Risk-based ongoing transaction monitoring and periodic merchant re-KYC. Dedicated compliance team filing STRs with FIU-IND under PMLA. Full adherence to RBI’s KYC Master Directions and Payment Aggregator Guidelines<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n Network Tokenization via Magic Checkout<\/h3>\n
\n
- Magic Checkout integrates network tokenization directly into the checkout, so returning customers complete payment without re-entering card details while raw card data never passes through your servers.<\/li>\n
- Especially valuable for D2C and Shopify sellers – saved data sits at the card network level.<\/li>\n<\/ul>\n
RBI-Licensed Payment Aggregator Status<\/h3>\n
\n
- As an authorised Payment Aggregator, Razorpay handles funds directly. Settlements are subject to RBI escrow requirements, keeping merchant funds segregated.<\/li>\n
- This also means Razorpay is subject to RBI audits and compliance reviews.<\/li>\n<\/ul>\n
The n8n Integration for Secure Agentic Payments<\/h3>\n
\n
- Razorpay offers an official native integration with n8n, enabling AI-powered payment workflows without custom API code.<\/li>\n
- Automated workflows inherit signed webhook verification and idempotency controls, relevant for agentic payments.<\/li>\n<\/ul>\n
What Compliance Standards Govern Payment Gateway Security in India?<\/h2>\n
Payment gateway security in India is governed by two parallel frameworks: PCI DSS, the global card industry standard, and the RBI’s Digital Payment Security Controls Directions. Both are mandatory, and both changed in 2025 and 2026.<\/p>\n
PCI DSS v4.0.1 – What Changed and What Is Now Mandatory<\/h3>\n
\n
- PCI DSS v4.0.1 became the active standard, with all future-dated requirements enforceable from March 31, 2025, per the PCI Security Standards Council.<\/li>\n
- Two new requirements directly affect ecommerce merchants, not just providers.<\/li>\n<\/ul>\n
Requirement 6.4.3 – Script Integrity on Payment Pages<\/h4>\n
\n
- Every script on a payment page must be inventoried, authorised, and verified for integrity.<\/li>\n
- This combats e-skimming attacks that inject malicious JavaScript to steal card data, per the PCI Security Standards Council.<\/li>\n
- Your responsibility: maintain a script inventory and use Subresource Integrity hashing or a Content Security Policy.<\/li>\n<\/ul>\n
Requirement 11.6.1 – Tamper Detection on Payment Pages<\/h4>\n
\n
- Merchants must implement a mechanism that detects unauthorised changes to HTTP headers and payment page scripts, and alerts personnel.<\/li>\n<\/ul>\n
PCI DSS Compliance Levels<\/h4>\n
\n\n
\n \nLevel<\/th>\n Criteria<\/th>\n Required Assessment<\/th>\n<\/tr>\n<\/thead>\n \n Level 1<\/td>\n Over 6 million transactions\/year<\/td>\n Annual on-site QSA audit<\/td>\n<\/tr>\n \n Level 2<\/td>\n 1 to 6 million transactions\/year<\/td>\n Annual Self-Assessment Questionnaire (SAQ)<\/td>\n<\/tr>\n \n Level 3<\/td>\n 20,000 to 1 million e-commerce transactions\/year<\/td>\n Annual SAQ<\/td>\n<\/tr>\n \n Level 4<\/td>\n Under 20,000 e-commerce transactions\/year<\/td>\n Annual SAQ recommended<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n