Why Tokens Hold the Key to the Future: De-Risking the Evolving Payments Ecosystem
As the payments ecosystem continues to grow in complexity, Aurélien Pichon, Senior Vice President and Head of Client Services at Visa CEMEA, explores the need for de-risking transactions while driving forward the customer experience – and how tokenization can best be deployed to achieve this.
The payments ecosystem is, undoubtedly, changing rapidly, growing in scope and sophistication. Consumer expectations are shaping behaviour, as customers increasingly demand seamless, faster and more diverse ways of paying, without compromising security. Yet, even as it opens up choice, the introduction of more gateways and layers introduces new risks.
Risks surrounding the payments landscape are varied, ranging from operational, reputational, geopolitical, and credit settlement risk, to the threat of fraud. But of all the risks associated with the increasing complexity of payments, the most prominent is fraud risk – which is growing sharply in the era of card-not-present (CNP) transactions. The challenge for payment providers, as a result, is to keep developing the ecosystem for their customers, while staying one step ahead of tech savvy fraudsters – and here, tokenization is already being utilised as a powerful tool to achieve just this.
Developing and De-risking
To take a closer view of the path ahead, particularly in the Central and Eastern Europe, Middle East and Africa (CEMEA) region, the payments ecosystem today has seen CNP transactions boom during and post-COVID 19 - which, in turn, has led to the proliferation and sophistication of enumeration attacks.
For any intermediaries along the payment journey, such as issuers, acquirers and payments facilitators, the transaction becomes riskier from a cybersecurity perspective, with potential financial risk; there is also a need to enable a frictionless payment experience for the customer, who might otherwise decide to disengage and, ultimately, choose a different payment option convenient for them. In tandem, these same players may face challenges around payment disputes, charge backs and liability – resolving which represents both cost and time.
Addressing the changing security challenge while maintaining swift, easy transactions may not seem to be immediately compatible goals, but there is a way to meet both objectives: through further innovation.
Innovation is the Answer
Today, tokenization can do wonders to de-risk the payments ecosystem and improve authorization rates for good, and only good transactions. Simply put, it works by replacing a customer’s sensitive payment data with a non-confidential ‘token’. When customers load their card details to their mobile or a merchant app, their primary account number (PAN), or card number, is replaced with a 16-digit equivalent, meaning that their critical details are not stored in their own device or shared with the merchant.
For the consumer, tokens offer security and convenience. These days, innovations such as tap to pay, electronic wallets, and wearables, mean there is no need at all to carry a physical card – and it is tokenization which helps to secure these options. Consumers can also enjoy a smoother payments experience: once they load their credentials into a platform, they no longer need to repeat the process when their card expires, as the relevant tokens are seamlessly updated in the background.
For the wider sector, the benefits of tokenization include the improved security and depersonalization of credentials, leading to lower risk for all payment ecosystem members. For Visa’s clients, partners and stakeholders, tokenization improves the lifecycle management of expired credentials, while - since a uniquely personalized token is generated for each combination of payer-merchant-device - reducing the probability and the negative impact of a security breach. Tokenization, in turn, significantly reduces fraud rates improving authorization rates. The Visa Token Service (VTS), for example, reduces fraud by transaction value by 26%1.
Meanwhile, the fraud levels for Visa’s EMV 3-D Secure - which can be used with VTS and supports with authentication - are five times lower than the CNP channel overall2. Lastly, tokenization enables issuers to facilitate further participation in specific markets, resulting in broader cardholder coverage. This encourages merchants to embrace tokens and the benefits they bring.
Supporting the Adoption of Tokens
The beauty of this technology is that it can be implemented easily into both financial and non-financial institutions’ systems, allowing the payments sector to build on its existing foundations, while this easy-to-maintain solution protects customers. Overall, in CEMEA, tokenization is well-established, supporting over 25% of Visa payment transactions in the region3. Zooming into the CEMEA region, various markets have so far responded in different ways, with some, like the Commonwealth of Independent States (CIS) and South-East Europe (SEE), making great progress. Likewise, penetration rates for tokens vary, especially for domestic transactions (as opposed to cross-border), meaning there is further room for take-up.
Helping acquirers, merchants and fintechs embrace the benefits of tokens, Visa offers several related solutions, including Token ID, which allows issuers to tailor tokenization to their needs; and Token Management Service (TMS) which securely connects multiple tokens into a single token to simplify the payment process. Visa is seeing growing use of these tools on eCommerce and CNP transactions, as well as business-to-business (B2B) and travel industry transactions.
In tandem, Visa’s Client Services team supports this work in de-risking the payments ecosystem and also strongly recommends its clients implement the Digital Authentication Framework (DAF). This framework is designed to achieve higher approval rates around CNP transactions, and the Secure Credential Framework (SCF) for tokenization and authentication. They also implement related risk-based solutions in authentication and authorization, including risk and identity products such as EMV 3-D Secure, an e-commerce fraud prevention protocol; Visa Risk Manager (VRM), a web portal offering fraud and risk management tools; and Visa Decision Manager, a fraud solution. Lastly, Client Services implements new solutions from the Visa Payment Fraud Disruption Team, such as the Visa Account Attack Intelligence (VAAI) model, which uses artificial intelligence to better evaluate CNP transactions to then be proactively shared with Visa’s partners. The evaluation includes identifying issuer BINs and merchants where hackers are using account enumerations to guess PANs, expiration dates or CVV2 and categorizing findings into dashboard alerts and reports that identify the most sophisticated attacks and their victims.
Tools for a New Era
Looking ahead, Visa is developing more tools which will allow clients to deploy tokens most effectively. Tokenization is already growing rapidly in CEMEA, and the priority now is for tokenization to be further expanded across CEMEA markets, so that more financial institutions, merchants and consumers can benefit from the ease and security it offers.
In tandem, as virtual cards – which can be thought of as tokenized cards – become more popular, the actors of the payment system can benefit. Issuers will be able to use a single platform for end-to-end business and payment processing, set authorization rules to protect against fraud, drive adoption, and optimize business-to-business payments. They, likewise, could see increased profit volume from medium and large ticket-size programs. Merchants and acquirers, meanwhile, can benefit from the convenience and relative safety offered to users relying on virtual cards.
As for the future, as tokenization evolves along with the continuing expansion of the digital world, from the development of blockchain and the enhanced digital security associated with that, to ever more refined digital transactional frameworks, and the tokenization of crypto assets, the use of tokens will only become more prevalent and sophisticated. In turn, more education and upgraded technological infrastructure will be needed to accompany this new paradigm. Along the way, as consumers continue to seek greater choice and speed in their payments, actors on both sides of the journey – merchants as well as banks and issuers - will need to ruthlessly seek opportunities to implement these new innovative tools that are now at their fingertips. The portfolio of options continues to grow, and so do the risk levels. Striking the right balance between upgrades, while promoting security will be the recipe for success for future winners.
Stay current with the latest payments insights from Visa Navigate CEMEA - subscribe today.
All brand names, logos and/or trademarks are the property of their respective owners, are used for identification purposes only, and do not necessarily imply product endorsement or affiliation with Visa.
1 Source: What is Visa Tokenization Service, endeavour, 26 May 2023, https://www.threedsecurempi.com/blog/what-is-visa-token-service/
2 Source: Visa CEMEA data
3 Source: Visa CEMEA data
4 Source: Visa Client Services data
Share Feedback