In expanding Visa Token Service, the card brand is requiring issuers to stop using alternate personal account numbers in cloud-based mobile payments and instead converting to tokenization.
Visa's updated specifications indicate the card brand at some point in the future will stop supporting alternate PANs, which are most common when an issuer deploys Host Card Emulation for mobile wallet services.
"Visa previously supported alternate PAN to support the enablement of issuer-created mobile wallet programs prior to EMV tokenization being available," Visa spokesperson Aida Hadzibegovic said. "It was restricted to a single use case – to enable Near Field Communication contactless transactions at the point of sale."
HCE software bypasses the secure element on the handset of a mobile phone, allowing a mobile wallet to initiate NFC contactless payments without relying on the secure element chip storing card credentials.
The alternate PAN is a 16-digit account number that links to the customer's main account number, with the first six digits being the same as the first six digits on the customer's plastic card. Those numbers also operate as the bank identification number in a transaction. Tokenization changes the BIN in the form of a specific token supplied on request by the card network.
With the proliferation of Internet of Things-enabled devices, Visa sees an opportunity to expand the use and acceptance of electronic payments globally, Hadzibegovic said.
"Now that EMV tokenization is adopted as a global standard for secure digital payments, and is gaining traction worldwide, we believe this is the right time to broaden support for tokenization and retire alternative PANs to help our partners enable new ways to pay," she added.
Visa announced two weeks ago it was offering
The timing of Visa’s pressure and its impact is yet to emerge. Because HCE is not yet common in the U.S., the new specifications are more likely to affect issuers in Europe, especially when Visa completes the Visa Europe acquisition. However, Hadzibegovic did not comment on the implications for Visa Europe.
In the U.S., the conversion to a token service should not carry much impact for issuers or merchants.
"Those issuers that have HCE are also supporting tokenization already, so I don't think the impact on U.S. merchants should be particularly significant," said Julie Conroy, research director and fraud expert with Boston-based Aite Group.
Even though the effect on merchants is "fairly minimal," some have complained about the potential to lose any ability to gather BIN-related intelligence on their customers, Conroy said.
"They can currently get that information from the alternate PAN, but they can't get it from a token service," said Conroy, who added that issue remains a common complaint from merchants about issuer tokenization.
With no date specified for discontinuing support of the alternate PAN, Visa is looking to make the transition to token services smooth for its clients that are using alternate PANs in their existing mobile wallet programs, Hadzibegovic said.
Tokenization services in general have become a key topic in the payments security industry since mobile wallets like Apple Pay and Samsung Pay began including tokenization as a security level.
But it's also relevant in that Visa, MasterCard and American Express initially have been the only issuer-based token service providers.
That status is likely to change over time, with more processors and providers getting into the mix, but it remains unclear if token service for mobile payments will become a
MasterCard extended its Digital Enablement Service to private label card users last summer, allowing companies like BJ's Wholesale Club, Kohl's and JCPenney to be the first retailers to extend mobile payments to their store-branded card users via MasterCard's tokenization service.
In a
