I hate to say “I told you so,” but as I wrote over two years ago in my blog, The Rewards of Tokenization, allowing Visa and Mastercard to exclusively tokenize their branded payment cards has placed them both in a strong position to dominate the U.S. card market. The partnership of The Clearing House (TCH) and Mastercard on the Secure Token Exchange product announced about a year ago has not yet produced tangible results. And while First Data’s agreement to pilot a tokenization service with Mastercard (which my colleague Tim Sloane wrote about in May 2018), is still in active development, it has not been officially rolled out.
On Wednesday, October 17, 2018 (coincidentally, a year to the day since the TCH-Mastercard partnership was announced), Visa announced it was expanding its Visa Token Service to merchants through 20 partners, including acquirers like CyberSource (which Visa owns), Elavon, Worldpay, and Square, gateways like Adyen, PayPal, and Braintree (which PayPal owns), and technology firms like Giesecke & Devrient and Rambus. On the same day, Mastercard also announced a similar initiative, with acquirers and gateways including Adyen (again), BlueSnap, Digital River, Stripe, Square, and Worldpay (again), plus the participation of two large issuers, Citi and Fifth Third Bank. Bank of America is going to provide “enhanced fraud scoring.” Conspicuous by their absence were several of the top U.S. acquirers, including First Data and its joint ventures with Bank of America Merchant Services and Wells Fargo Merchant Services, Global Payments and its Heartland acquisition, Citi Merchant Services, and Total System Services (TSYS).
Visa and Mastercard’s newly announced tokenization initiatives expand on their original tokenization services, which focused on card issuers. Now they are offering to tokenize card numbers held on file by merchants as part of the EMVCo Secure Remote Commerce (SRC) specification. SRC leverages 3D Secure 2.0 to extend EMV security into the e-commerce realm, the one area that was not addressed by the EMV chip card rollout. That is directly competitive with companies like First Data that already tokenize cards on file. (First Data does this through its TransArmor service.) Visa claims its solution will be interoperable with such solutions. Worldpay is apparently doing the same with its OmniToken product.
Note that many questions about Visa’s new card-on-file tokenization remain unanswered:
- Will merchants get on board? Amazon has its own tokenization service, AmazonPay, which relies on having actual card numbers on file, as does its Alexa service. They seem sufficiently confident of their own security that they have so far declined to implement strong authentication technology like 3D Secure. Other merchants may not like the idea of Visa having a window into their payments volume. Having all these acquirers and gateways on board is great, but without broad adoption by merchants, it may not go anywhere. And it is unclear how much incentive these partners really have to push the solution, especially if they already have their own solutions. When I met with one of the acquirers listed in the Visa press release, they were unexpectedly vague about their goals for the program, instead focusing on how their existing solution would continue to be employed for non-EMV cards, like closed loop and private label cards.
- As Tim Sloane asked in a blog post last Friday (October 19), how much will this card-on-file tokenization cost? Visa isn’t making any money on issuer-side tokenization, presumably to build market share, so it may see this as an opportunity to monetize.
- Will this put more urgency into alternative tokenization efforts, or is it too late?
In short, this looks like a smart move for Visa and Mastercard. It leverages their tokenization infrastructure, offers a more standardized approach for card-on-file tokenization, and potentially diversifies their revenue stream, ensuring continued growth even if emerging faster payments networks start to siphon off card transactions. I continue to wonder, though, why there has not been a more concerted attempt to contain Visa and Mastercard’s growing market power, beyond the merchant class-action lawsuits. Visa and Mastercard are clearly taking advantage of a fragmented market to make inroads, and the lack of coordination and cooperation between other market players is giving them a free hand.
Editor’s Note: An earlier version of this article incorrectly stated that First Data’s tokenization partnership with Mastercard had “stalled.” It is still under active development.
