EMVCo, the EMV standard governing body has released specifications for payment tokenization, a process that it says will strengthen security when consumers make digital payments through personal computers or mobile devices.
Tokenization replaces card account data with a secure value called a token, which is meant to be worthless to a fraudster if it is ever stolen. EMVCo has requested industry input on its technical document for implementing tokenization in online or mobile payment network development. Based on feedback it receives, EMVCo plans to broaden the specification's relevance and uses as it evolves.
The technical framework is designed to help merchants, acquirers, card issuers or new payment entrants develop interoperable tokenization software, EMVCo states in a March 11 press release. American Express, Discover, JCB, MasterCard, UnionPay and Visa collectively own EMVCo, which establishes operational standards for the use of chip-based smart cards.
The development of an EMV tokenization specification for e-commerce and mobile payments addresses a main concern of U.S. acquirers and merchants, who have feared card fraud will move to e-commerce when the U.S. implements EMV cards at the physical point of sale.
The U.S. payments industry has begun its migration to EMV chip-based cards, with the major card brands placing an October 2015 deadline for most merchants. Those not capable of handling EMV smart cards after that date would carry the liability in fraud cases.
EMVCo announced its pursuit of a global security standard for tokenization last month, saying it was seeking more security for card-not-present EMV transactions.
Many tokenization systems already exist in the payments industry, but EMVCo wants to facilitate "global interoperability and acceptance of secure payment transactions," says EMVCo board chair Christina Hulka, in a press release.
EMVCo will work with interested parties to ensure that industry needs are met across stakeholders, Hulka adds. "This will enable us to create a standardized, secure and reliable environment across all payment channels."
The new specification will complement existing EMV-chip specifications and be compatible with current payment infrastructure, EMVCo says.
The EMVCo document also describes the role the tokenization specification will have in facilitating broad-based acceptance of a payment token as a replacement for a card account number. As such, the standard includes data message formats to ensure interoperability and a consistent approach to be used to route and authenticate a payment token, EMVCo says.