Visa and MasterCard Push for Tokenization

While Visa and MasterCard aren't yet applying the same level of pressure for tokenization security as they are for EMV-chip cards, the card networks' CEOs are clear that this technology is their new expectation for e-commerce.

Tokenization replaces sensitive account data with a secure value called a "token," which is meant to be worthless to fraudsters. The networks' more aggressive support of this technology, which be used to counter any fraud that migrates online after EMV is in place at the point of sale, could prove expensive for issuers, said Richard Crone, a payments consultant.

"In terms of applying pressure, the card networks hold the cards in terms of their tokenization service," Crone said. "The issuer has to pay to [use] these tokens...and for any exception that occurs…that is why [the card networks] are so bullish when talking about this with the investment community."

Visa is using the buzz around Apple Pay to draw attention to tokenization, which is one of the security methods used in Apple's mobile wallet. To date, 43 Visa-issuing banks have enrolled in Visa's tokenization service and Apple Pay, representing 75% of Visa's aggregate U.S. payment volume. However, that leaves more than 500 banks that have signed up for Apple Pay but do not yet use tokenization, Visa CEO Charlie Scharf said during a Jan. 29 conference call to discuss fourth-quarter earnings. "Tokenization is a prerequisite to work with Apple Pay," Scharf noted.

But the expenses tied to Apple Pay and other implementations of tokenization is already prompting issuers to explore alternatives such as the CurrentC wallet being developed by theMerchant Customer Exchange (MCX), an initiative backed by Walmart, Target and other major retailers, Crone said.

"That is why you have issuers engaged in direct dialogue with MCX," Crone said. MCX's planned approach tokenizes the entire payment session, and does not store credentials on the phone or the point of sale. "It's safer than the Apple Pay, Visa and MasterCard approaches, but the most important part is they get the benefits of safe tokenization without having to rely on or pay Visa and MasterCard for these services."

While Visa, MasterCard and American Express are working off a common set of standards to develop tokenization, each company is building and marketing its own solution. The card networks have not publically discussed tokenization fees, but MasterCard has already drawn fire over its potential plans to charge for parts of the token conversion process.

There are other costs associated with tokenization, such as the fees paid for supporting Apple Pay transactions as well as soft costs such as customer support, which Apple and the card networks do not provide, Crone said.

Visa has made tokenization part of a multi-pronged approach to security that also includes deploying EMV-chip cards at the point of sale and replacing the use of passwords online.

Visa is additionally approaching issuers outside the U.S. to develop tokenization solutions, Scharf said.

"We would expect to see some tokenized solutions in the marketplace this calendar year," he said, adding there is also an "active" dialogue with other handset manufacturers besides Apple, "but the work that Apple has done … has certainly accelerated people's thinking."

MasterCard is also developing tokenization for browser-based purchases, with products expected in the market over the next few quarters, said Ajay Banga, MasterCard's CEO, during a Jan. 30 conference call to discuss the company's earnings. MasterCard has previously stated that it will start this push by adding tokenization to its own MasterPass wallet.