Mastercard to debut universal buy button with small-merchant security in mind

Register now

Developers of new payment methods often court big retailers to show off their brand, but the card networks' universal buy button is launching with security features designed for smaller shops.

The buy button is an implementation of Secure Remote Commerce (SRC), for which EMVCo released the v1.0 specification on Friday. Its goal isn't to compete with PayPal or Zelle or any other digital-first payment mechanism; instead, it's built to limit the exposure of payment credentials for one-off purchases. And while a new payment method is much less meaningful at a major brand like or Best Buy — where consumers likely already have a card on file for online purchases — it can be beneficial to small stores where people shop less frequently.

“I believe that SRC will benefit all retailers but will have a significant impact on smaller and independent retailers who can use SRC and our NuData [artificial intelligence] and other fraud capabilities,” stated Jess Turner, EVP of digital payments and labs, North America at Mastercard.

These services are being bundled under the label of Mastercard Digital Wellness, launching Friday. SRC was announced last year as a way to allow consumers to use their bank apps to approve payments for guest checkouts at merchants they're unfamiliar with. This limits the risk that those credentials will be intercepted by malware or exposed in a data breach.

Mastercard merchants who deploy the new standard will automatically get access to an added layer of security through tokenization and NuData, a Mastercard AI and machine learning technology. Mastercard is working with payment processors including Square, Worldpay, Adyen, MPGS and others to make these features available to business more quickly.

Mastercard reported that during the 2018 holiday season, NuData helped businesses worldwide identify over one billion irregular digital activities and stopped 99% of the fraudulent attacks, saving them over $500 million in potential fraud losses.

“The long tail of the market doesn’t typically have the reach and bandwidth to access these tools," Turner said. "The Mastercard Digital Wellness program puts that access within easy reach."

Online merchants have come under heavy pressure from fraudsters who have targeted the card not present (CNP) channel due in part to the entry of EMV cards in 2015 in the U.S. market. SRC standard uses tokenization to emulate EMV security for digital purchases.

“I believe that this is the first implementation of SRC to merchants and the user experience that they describe would be a benefit to consumers and merchants. Further, an added layer of security for CNP transactions will be a real positive for merchants, given the increase in CNP fraud caused by implementation of EMV at the POS,” said Thad Peterson, senior analyst at Aite Group.

Other card brands have their own projects underway for SRC. Discover announced Friday that it would bring its system to market sometime this year.

Mastercard has been part of a year-long journey to bring EMVCo’s SRC standard to market as part of a common checkout button. Last year, Mastercard called on industry support for a SRC as it would deliver a more consistent checkout experience for consumers.

Visa has also supported the SRC standard of creating a single buy button when it was first announced the ETA Transact conference in April 2018. Discover announced its support of the initial SRC draft in October 2018 and called on broader industry feedback to help shape the standards before the first official release.

Despite this wide industry support, the effort has invited skepticism.

“The question is how this new solution is adopted and used by the merchant," Peterson said. "It is most likely going to be positioned as an additional payment alternative as merchants aren’t going to risk losing their PayPal customers, as well as their existing card-on-file customer bases."

Joshua Karoly, Netflix’s director of payments, put it more bluntly.

“No offense against Mastercard, but Masterpass or Visa Checkout, they come and they try to sell you on that point, and I don’t want NASCAR on my checkout flow. I want to keep it as simple as possible,” Karoly said at SourceMedia’s Card Forum last month in New Orleans.

Karoly was supportive of Mastercard's efforts with SRC as a more unified system. “They kind of took that [feedback] to heart and came together finally," he said.

For reprint and licensing requests for this article, click here.
Digital ID Digital payments Online payments Cyber security Network rules Mastercard