FREE forever · no login for checks and guides

Payment Gateway & Online Collection Safety

Choosing a licensed gateway, never storing card data, settlement-account controls, refund fraud, chargeback evidence and the RBI tokenisation rule.

Collect online through a licensed payment aggregator and let it carry the card risk. Your job is the settlement account and the refund process.

Choosing

Use an RBI-licensed payment aggregator; check the licence on the RBI list; prefer one that supports UPI, cards and payment links with a dashboard and webhooks.

Controls

Settlement to a current account with alerts; dashboard access with 2FA and separate users; refunds approved by one named person; never share the gateway API keys in chat; rotate keys when staff leave.

Fraud and chargebacks

Keep proof of delivery / service for every order (chargeback evidence); watch for refund fraud (cancel after dispatch); do not process ‘test’ payments from a customer's card at their request.

Cards

RBI rules require cards to be tokenised — you never store or see card numbers. Any process that asks a customer for a card number over WhatsApp or a form is both illegal and a breach waiting to happen.

Checklist

  • ☐Licensed aggregator (checked on the RBI list)
  • ☐Dashboard 2FA, separate users
  • ☐API keys stored securely, rotated on exit
  • ☐Refund approval by one named person
  • ☐Delivery / service proof kept per order
  • ☐No card numbers ever handled directly

Questions people ask

Can we collect card numbers over WhatsApp?

No — never store or handle card numbers yourself. Send a payment link from a licensed gateway; RBI rules require cards to be tokenised.

Been hit and need a human?

Our team helps you draft, file and follow up with the bank and the cyber cell — leave your number for a free callback.

More on the Cyber Desk

All 61 free tools →

The Cyber Desk provides educational tools, checklists and self-help drafts — not legal advice. For serious or high-value fraud, also consult the police and a qualified lawyer.