Visa bets on tokenization to stay relevant in India’s payments race

India does not do anything small. The country that built UPI into a two-billion-transaction-per-month machine has now quietly become the most tokenized e-commerce market on the planet for card payments. And Visa is right at the center of it.

As of July 2026, more than 900 million payment tokens are circulating across India’s digital payments ecosystem. Visa accounts for nearly 500 million of those tokens, a figure that reflects both regulatory pressure and a deliberate company strategy to stay competitive in a market where the default payment method for hundreds of millions of people is a QR code, not a card.

Why India went all-in on tokenization

The backstory starts with the Reserve Bank of India. In October 2022, the RBI issued a mandate requiring merchants to stop storing raw card details on their servers. No more saving 16-digit card numbers in databases that become honeypots for hackers. Instead, each card gets replaced by a unique payment token, a randomized string that is useless to anyone who intercepts it.

The regulation forced adoption at scale, and India’s digital payments infrastructure moved fast enough to absorb it. The result: India is now described as 100% tokenized for e-commerce card transactions, meaning every online card payment in the country runs through this token-based system.

Visa moved early on Card-on-File tokenization services, which helped merchants integrate quickly and built institutional familiarity with Visa’s infrastructure before rivals could consolidate.

Payment Passkey and the friction problem

Tokenization handles the security layer, but it does not fix the part of online checkout that actually annoys people: the one-time password.

Visa launched Payment Passkey in India on July 2, 2026, specifically to address this problem. The system replaces the OTP with device-based biometric authentication, the same fingerprint or face recognition you already use to unlock your phone. The card is still tokenized, the transaction is still secure, but the verification step happens in under a second without waiting for a text message.

The OTP-to-passkey shift also reduces exposure to SIM-swap fraud, where attackers port a victim’s phone number to a new SIM card and intercept authentication messages. Device-based authentication does not travel with a phone number, so that particular attack vector closes.

Taking on UPI on its own turf

The partnership with PhonePe, announced in September 2026, is the clearest signal of that strategy. The collaboration introduced Tap to Pay, which allows contactless smartphone payments using tokenized Visa cards, alongside cross-border Visa QR payment capabilities across 14 markets.

Putting tokenized card payments inside PhonePe, one of India’s dominant UPI apps, means Visa is embedding card infrastructure inside that familiar experience, extending reach without demanding a behavior change.

Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.