Visa, MC, Amex Push to Replace Account Numbers in Digital Payments
Visa, MasterCard and American Express introduced a proposed framework for new global standards that would replace traditional account numbers with a digital payment "token" for online and mobile transactions.
The networks say it is important to act before mobile payments systems become large enough to pose interoperability issues.
"Digital payments are emerging and will grow rapidly in the years ahead, and as we worked together on standards in the plastic world, we wanted to get together to form standards in advance of digital payments taking off," says Mike Matan, head of global network business for American Express.
The tokens would provide an additional layer of security and eliminate the need for merchants and other parties to store sensitive payment data.
The card networks are also proposing the use of data fields to provide richer information about the transaction to inform fraud detection and expedite the approval process; consistent methods to identify and verify a consumer before replacing the card number with a token; and a common standard to simplify the process for merchants to offer contactless, online or other digital transactions.
"I think the sentiment behind this announcement is encouraging Digital commerce is a very attractive target for fraudsters, [and fraud] will continue as long as the card-not-present channels rely upon static data," says Julie Conroy, a research director for Aite Group.
"Replacement of the 16-digit card number with a token could also make the mobile experience easier," since the standard would allow consumers to make fewer keystrokes to execute mobile transactions, Conroy says.
Once standards are agreed to and implemented, merchants, issuers and digital wallet providers would be able to request a token in place of a shopper's account number. The token would be used to process, authorize, clear and settle the transaction in the same way account numbers are used today. Tokens could also be restricted to use with a specific merchant, device, transaction or category of transactions.
The proposed framework incorporated the input of a number of payments industry stakeholders, particularly card issuers and merchants, the card networks said.
"The more interoperability we can bring to payments, the more we can help expand the industry," Matan says.
Over the coming weeks, the card networks will present the framework to other organizations, such as The Clearing House, PCI Security Standards Council and EMVCo, to align and further advance the standard. They will set a timeframe for the program based on how quickly the industry can come together to develop and adopt the final global standard, says Ed McLaughlin, chief emerging payments officer for MasterCard, in an email to PaymentsSource.
"As with any broad changes to the payment systems, the devil will be in the details, and in this case there are a lot of details to think through," Conroy says. "Changing consumer behavior is always quite challenging and this sounds like it will require a fairly significant change. There are a number of fraud prevention systems that [use account numbers] as part of the process, how will these have to adapt?"
Other payments companies are developing ways to replace account numbers with simpler ways to authorize and execute payments. ClearXchange enables payments between member banks by using an email address or mobile phone number. PayPal has long allowed an email address and password to take the place of account numbers for online purchases, and it also allows the use of PINs and phone numbers at the point of sale. Visa's V.me and MasterCard's MasterPass also support simplified methods of paying online merchants.
The card networks say the key principles in their initiative are driving the development of a token standard for digital payments; ensuring broad-based acceptance of a token as replacement for the traditional card account; enabling all participants to route and pass through the payment token; enabling digital wallet operators, mobile application developers and others to easily and securely develop payment products; and improving cardholder security with tokens that are limited for use in specific environments.
"The right players are at the table driving this," Conroy says. "Given the magnitude of the change, and the number of details to think through, this won't happen overnight, but I think the direction is positive."
Since the standards will be global, it will be easier for companies that operate in the payments space to get on board, Matan says, adding that the networks will engage companies that use account numbers as part of authorization.
"It's probably too early to get into specifics, but we will talk with standards bodies and will work with all participants to make the transition as seamless as possible," Matan says.