Coronavirus puts greater onus on tokenization for e-commerce security

Tokenization and buy buttons began, in part, as ways to calm the security concerns of online shoppers who were wary of moving away from plastic. They’re now becoming a way to keep a health and economic crisis from turning into a security problem as in-store checkout quickly gives way to apps and websites.

These technologies were incremental projects for the major card brands, the sort of multiyear project that exists almost as a backdrop to other projects. There’s been occasional updates, pressure win over skeptical merchants, releases and supportive updates for investors from card execs. As individual products and projects push specific mobile and digital payment innovation, the goal of secure remote commerce (SRC, the "buy button") and tokenization has been to gradually move more people toward online transactions by standardizing the experience and making it agnostic to the user, if not invisible.

“Innovations such as tokenization and SRC are not a response to the coronavirus pandemic. But the experience, the security and the lack of friction at checkout have never been more important," said Brian Cole, head of product for Visa North America.

An early finish line for SRC came in January when Visa began phasing out Visa Checkout in favor of SRC. The timing was coincidental, as a forced move to online commerce was just around the corner.

The pandemic shut thousands of physical stores, and has redefined the concept of digital. Stores that were tinkering with online ordering were all of a sudden forced to become e-commerce merchants. That’s bringing new digital payment flows from businesses that would have eventually moved online, but likely not for many years.

“We’ve been seeing a migration to e-commerce over the last 15 years, but we’re really seeing it now as a result of the shelter in place orders,” Cole said.

Visa recently reported contactless payments grew 40% in the most recent quarter compared to a year ago, while card-not-present payments grew 18% in April alone. Card-present payments fell 45% during the month. Visa says these trends mark a permanent shift to digital.

The pressure on card brands is creating an online experience that’s not apparent to the consumer, requiring no adjustments and little awareness of the processing. If tokenization or a universal buy button work right, the consumer doesn’t even know what it is, and won’t choose a card based on how easy it is to use on a website or app.

“As commerce moves online we have to make sure we move quickly to make sure authorization rates are the same as if you walked up to a point of sale terminal,” Cole said.

Visa’s relying partly on collaborations to build merchant support for that experience. On Wednesday it added partners for its tokenization service and SRC. The tokenization partners include BlueSnap, Moneris and about two dozen other merchant acquiring gateways.

These firms allow Visa to build a network effect without having to close deals with thousands of individual merchants, with the card company saying it’s reached 61 million merchant locations. Visa also said it’s migrated 10,000 online merchants to click-to-pay since January, as online shopping has increased 25% in the U.S. during the past two months.

Tokenization replaces a card number with a representative number that’s usable for only a single transaction, then discarded — so if it’s stolen, it’s worthless to the crook.

It’s an older technology and has been used to protect cryptocurrency transactions, fuel payments and as a way to speed payment processing for e-commerce.

“The coronavirus pandemic is escalating the need to tokenize everything as cybersecurity risks escalate,” said Krista Tedder, head of payments for Javelin Strategy & Research, “Tokenization continually evolves; what will change is that everyone will be moving towards tokenization for both security and privacy.”

Both Visa and Mastercard have partnered with technology firms such as MeaWallet to add scale to their tokens. These tokens are helpful in supporting buy buttons, since they provide security by assigning the tokens to transactions based on stored credentials for repeat purchases.

The jump in e-commerce during the pandemic places more pressure on tokens and buy buttons to work safely.

“If e-commerce merchants and marketplaces are hacked, the potential consequences are increased,” said Rick Oglesby, founder and president of AZ Payments Group. “It should increase the demand for tokenized transactions, as well as the demand for checkout facilitation technologies (such as wallets) that combine ease of checkout with tokenization.”

Tokenization also allows companies to let go of sensitive data, creating more of a need for the card companies to build their merchant networks through acquirers. Visa's Wednesday additions join a roster of acquirers and gateways Visa has been building for more than a year.

“Getting rid of data means tokenizing your entire database,” Oglesby said. “So while payment networks and wallet solutions can provide partial solutions, it’s really the merchant services providers and gateways that are in the best position to take advantage of these trends.”