The card that fights back: India’s next era of payment card security
By Naresh Rao, VP & Sales Head Issuance Products, Giesecke+Devrient (G+D)
India’s digital payments ecosystem has become one of the world’s biggest success stories. From neighborhood Kirana stores to global e-commerce platforms, Indian consumers can now reliably expect every payment to be instant and seamless everywhere. But the same convenience that has fueled this growth has also created new opportunities for fraud.
According to RBI data, there has been a more-than-tenfold surge in reported fraud between 2021 and 2025, with the Reserve Bank of India (RBI) reporting that losses soared from INR 551 crore to INR 22,931 crore during that period.
At the heart of this trend is the fact that, with consumers more inclined to transact online and save their card details, those credentials become easier target for cybercriminals.
From payment tool to security device
For decades, payment cards were designed to identify an account and authorise a transaction. If there is no two-factor authentication (2FA) or PIN in place for online transactions, fraudsters can exploit credentials linked to a card and, once they are compromised, execute fraudulent transactions within minutes. So, one of the simplest ways to strengthen security is to expose less data.
While traditional cards boldly display information such as the card number and expiry date, numberless card designs, or even more advanced solutions, as described below, remove these details to limit the information exposed if a card is lost, stolen, or even photographed.
This complements the RBI’s tokenisation mandate, which encourages the replacement of card credentials with secure tokens for online transactions. If tokenisation protects data stored by merchants, numberless cards apply the same principle to the card itself and thereby reduce the amount of sensitive information available to steal.
Making stolen credentials obsolete
Even when card details are compromised, they should not remain useful to the attacker. Augmented by artificial intelligence (AI), increasingly sophisticated phishing campaigns and card-not-present (CNP) attacks are exposing the limits of traditional card security.
These methods allow fraudsters to steal credentials without ever having to devise any direct means of targeting a potential victim’s physical card. Therefore, ensuring the integrity of payments can no longer depend solely on systems operating behind the scenes.
The payment card itself must become a more active part of the security architecture, which is why the next generation of payment cards is being designed to both enable payments and actively reduce fraud. While static CVVs give criminals the opportunity to exploit stolen credentials, dynamic CVV technology regularly changes the security code, shortening the window for exploiting stolen card details. For Indian issuers, this also reduces reliance on SMS-based OTPs, adding another robust layer of authentication to minimise vulnerability to phishing and SIM-swap attacks.
Verifying the person, not just the card
The biggest shift is that payment cards are beginning to authenticate the user, not merely identify the account. Technologies such as FIDO-based authentication and biometric payment cards replace static credentials with phishing-resistant authentication or onboard fingerprint verification.
Instead of asking whether the right card details have been entered, they confirm that the legitimate cardholder is present, enabling payments that are anchored in secure account access and identity verification.
For India, where biometric authentication is already familiar, consumers should not have to choose between security and convenience. The most effective protection is increasingly the least visible, built into the payment experience rather than added through extra steps.
As India’s digital payments ecosystem grows, the role of the payment card is changing fundamentally. It is no longer just a payment credential but an intelligent security device. Issuers should leverage this to reduce data exposure and verify identity more effectively, while minimising the risk of stolen credentials. That evolution will be essential to sustaining trust. Failure to do so could well derail the next phase of India’s digital payments journey.