Merchants and financial institutions agree that tokenization has the potential to dominate mobile and online banking. However, further coordination among payment processors, card networks and other stakeholders is needed before tokenization can progress throughout the industry, according to a paper released by the Federal Reserve Bank of Boston.
The Boston Fed interviewed tokenization stakeholders to shed light on potential improvements for the industry. The resulting paper, published last month, “Is Payments Tokenization Ready for Primetime? Perspectives from Industry Stakeholders on the Tokenization Landscape,” outlines the advantages and pitfalls of tokenization, and why stakeholders believe it will shape the future of mobile and online payment landscapes.
Tokenization is the process by which personal card information is substituted with a random string of numbers that have little to no meaning outside of a company’s database. A new random code, or “token,” is assigned for every individual transaction.
“If you take away the real number and sensitive data from the transaction at the very beginning, there’s nothing left for the fraudster to do,” said Marianne Crowe, co-author and vice president in the treasury and financial services of the Boston Fed. “[As a result,] this system of payment is more secure because it discourages cyber thieves from exploiting sensitive data and making counterfeit cards.”
“The security of payments has been the main concern of consumers in the mobile and digital space,” she added. “We wrote the paper to share it as a basic educational document because we sensed that there was a lot of confusion in the industry.”
Each stakeholder addressed what provisions and processes are required to further collaboration between them. The Boston Fed said this paper will help enlighten stakeholders to the potential improvements of tokenization and how the industry can put consumers first.
“The paper started a conversation between industry stakeholders, many of them competitors, to put tokenization into play,” Susan Pandy, co-author and director of payment strategies at the Boston Fed, told Banker & Tradesman. “Our goal is to resolve what issues we can and stimulate this important and sometimes difficult conversation about tokenization.”
All four major card networks have contributed to the tokenization model. In March 2014, Visa and MasterCard formed the Payment Security Taskforce (PSTF) to focus on enhancing payment security.
“The PSTF members want to enhance payment security by sharing ideas to break down barriers and spur adoption of next generation security solutions for the benefit of all,” the paper’s authors wrote.
The Advent Of Apple Pay
But MasterCard, Visa, American Express and Discover only represent one side of the tokenization model. Payment processors like Apple Pay offer different solutions to help tokenization security.
Apple Pay, the main payment processor represented, integrated multiple accounts to their iOS mobile wallet across multiple device platforms in October 2014, which helped expose tokenization technology to consumers.
“When Apple Pay came out with their new mobile wallet, it lent credibility to the (tokenization) process,” Crowe said of the slow adoption of tokenization.
Multiple large financial institutions supported Apply Pay “based on the underlying security, capacity of scalability, and comfort level with data management,” the paper noted. The financial institutions gave positive feedback for Apple Pay’s smartphone-based transactions, in part because a cell phone can simply be wiped remotely if lost or stolen, adding a “greater degree of security.”
However, programs like Apple Pay are still in their preliminary stages, the paper said. Financial institutions focus their concern on the provisioning process and in-app purchasing fraud potential, but support the complicated authentication and authorization systems of Apple Pay.
Merchants believe the most potential benefits of tokenization lie in the mobile platform, according to the paper. The interviews revealed that merchants wanted specifications of the tokenization process in order for them to accept any individual mobile-wallet programs.
According to the paper, USA Technologies will make Apple Pay available in 200,000 of its vending machines in 2015, and Coca Cola will make Apple Pay available in over 100,000 of its vending machines this year as well.
With the impending universal adoption of tokenization looming, the Merchant Advisory Group (MAG) recommended several ideas for stakeholders to help develop a universally benefitting tokenization model.
Looking forward, MAG imagines an accredited standards body owning and managing tokenization standards that would be developed to support multiple business models. MAG also hopes that through the standardization of tokenization, each company will encrypt and limit all data captured through tokenization to promote the security of its users.
“Merchants want a smooth process between the back-end tokenization they use in their database, and the tokenization used during the payment-piece of the process,” Crowe said. “The industry needs to work on the coordination between merchants and the banks and networks. … They need to work out those details.”
Crowe said though she cannot predict what the future of tokenization holds, Samsung and other networks show promise by offering mobile wallets this coming year. With a little more education and coordination, Crowe believes that the industry will work out the kinks so tokenization can “run smoothly” across the board.
“Tokenization looks like something everyone feels more secure about,” Crowe said. “The tokenization process works.”
